sys/netinet/sctp_asconf.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * a) Redistributions of source code must retain the above copyright notice,
  12  *    this list of conditions and the following disclaimer.
  13  *
  14  * b) Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the distribution.
  17  *
  18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  19  *    contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <netinet/sctp_os.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #include <netinet/sctp_pcb.h>
  42 #include <netinet/sctp_header.h>
  43 #include <netinet/sctputil.h>
  44 #include <netinet/sctp_output.h>
  45 #include <netinet/sctp_asconf.h>
  46 #include <netinet/sctp_timer.h>
  47
  48 /*
  49  * debug flags:
  50  * SCTP_DEBUG_ASCONF1: protocol info, general info and errors
  51  * SCTP_DEBUG_ASCONF2: detailed info
  52  */
  53
  54 /*
  55  * RFC 5061
  56  *
  57  * An ASCONF parameter queue exists per asoc which holds the pending address
  58  * operations.  Lists are updated upon receipt of ASCONF-ACK.
  59  *
  60  * A restricted_addrs list exists per assoc to hold local addresses that are
  61  * not (yet) usable by the assoc as a source address.  These addresses are
  62  * either pending an ASCONF operation (and exist on the ASCONF parameter
  63  * queue), or they are permanently restricted (the peer has returned an
  64  * ERROR indication to an ASCONF(ADD), or the peer does not support ASCONF).
  65  *
  66  * Deleted addresses are always immediately removed from the lists as they will
  67  * (shortly) no longer exist in the kernel.  We send ASCONFs as a courtesy,
  68  * only if allowed.
  69  */
  70
  71 /*
  72  * ASCONF parameter processing.
  73  * response_required: set if a reply is required (eg. SUCCESS_REPORT).
  74  * returns a mbuf to an "error" response parameter or NULL/"success" if ok.
  75  * FIX: allocating this many mbufs on the fly is pretty inefficient...
  76  */
  77 static struct mbuf *
  78 sctp_asconf_success_response(uint32_t id)
  79 {
  80         struct mbuf *m_reply = NULL;
  81         struct sctp_asconf_paramhdr *aph;
  82
  83         m_reply = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_paramhdr),
  84             0, M_NOWAIT, 1, MT_DATA);
  85         if (m_reply == NULL) {
  86                 SCTPDBG(SCTP_DEBUG_ASCONF1,
  87                     "asconf_success_response: couldn't get mbuf!\n");
  88                 return (NULL);
  89         }
  90         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
  91         aph->correlation_id = id;
  92         aph->ph.param_type = htons(SCTP_SUCCESS_REPORT);
  93         aph->ph.param_length = sizeof(struct sctp_asconf_paramhdr);
  94         SCTP_BUF_LEN(m_reply) = aph->ph.param_length;
  95         aph->ph.param_length = htons(aph->ph.param_length);
  96
  97         return (m_reply);
  98 }
  99
 100 static struct mbuf *
 101 sctp_asconf_error_response(uint32_t id, uint16_t cause, uint8_t *error_tlv,
 102     uint16_t tlv_length)
 103 {
 104         struct mbuf *m_reply = NULL;
 105         struct sctp_asconf_paramhdr *aph;
 106         struct sctp_error_cause *error;
 107         uint32_t buf_len;
 108         uint16_t i, param_length, cause_length, padding_length;
 109         uint8_t *tlv;
 110
 111         if (error_tlv == NULL) {
 112                 tlv_length = 0;
 113         }
 114         cause_length = sizeof(struct sctp_error_cause) + tlv_length;
 115         param_length = sizeof(struct sctp_asconf_paramhdr) + cause_length;
 116         padding_length = tlv_length % 4;
 117         if (padding_length != 0) {
 118                 padding_length = 4 - padding_length;
 119         }
 120         buf_len = param_length + padding_length;
 121         if (buf_len > MLEN) {
 122                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 123                     "asconf_error_response: tlv_length (%xh) too big\n",
 124                     tlv_length);
 125                 return (NULL);
 126         }
 127         m_reply = sctp_get_mbuf_for_msg(buf_len, 0, M_NOWAIT, 1, MT_DATA);
 128         if (m_reply == NULL) {
 129                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 130                     "asconf_error_response: couldn't get mbuf!\n");
 131                 return (NULL);
 132         }
 133         aph = mtod(m_reply, struct sctp_asconf_paramhdr *);
 134         aph->ph.param_type = htons(SCTP_ERROR_CAUSE_IND);
 135         aph->ph.param_length = htons(param_length);
 136         aph->correlation_id = id;
 137         error = (struct sctp_error_cause *)(aph + 1);
 138         error->code = htons(cause);
 139         error->length = htons(cause_length);
 140         if (error_tlv != NULL) {
 141                 tlv = (uint8_t *)(error + 1);
 142                 memcpy(tlv, error_tlv, tlv_length);
 143                 for (i = 0; i < padding_length; i++) {
 144                         tlv[tlv_length + i] = 0;
 145                 }
 146         }
 147         SCTP_BUF_LEN(m_reply) = buf_len;
 148         return (m_reply);
 149 }
 150
 151 static struct mbuf *
 152 sctp_process_asconf_add_ip(struct sockaddr *src, struct sctp_asconf_paramhdr *aph,
 153     struct sctp_tcb *stcb, int send_hb, int response_required)
 154 {
 155         struct sctp_nets *net;
 156         struct mbuf *m_reply = NULL;
 157         union sctp_sockstore store;
 158         struct sctp_paramhdr *ph;
 159         uint16_t param_type, aparam_length;
 160 #if defined(INET) || defined(INET6)
 161         uint16_t param_length;
 162 #endif
 163         struct sockaddr *sa;
 164         int zero_address = 0;
 165         int bad_address = 0;
 166 #ifdef INET
 167         struct sockaddr_in *sin;
 168         struct sctp_ipv4addr_param *v4addr;
 169 #endif
 170 #ifdef INET6
 171         struct sockaddr_in6 *sin6;
 172         struct sctp_ipv6addr_param *v6addr;
 173 #endif
 174
 175         aparam_length = ntohs(aph->ph.param_length);
 176         if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
 177                 return (NULL);
 178         }
 179         ph = (struct sctp_paramhdr *)(aph + 1);
 180         param_type = ntohs(ph->param_type);
 181 #if defined(INET) || defined(INET6)
 182         param_length = ntohs(ph->param_length);
 183         if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
 184                 return (NULL);
 185         }
 186 #endif
 187         sa = &store.sa;
 188         switch (param_type) {
 189 #ifdef INET
 190         case SCTP_IPV4_ADDRESS:
 191                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 192                         /* invalid param size */
 193                         return (NULL);
 194                 }
 195                 v4addr = (struct sctp_ipv4addr_param *)ph;
 196                 sin = &store.sin;
 197                 memset(sin, 0, sizeof(*sin));
 198                 sin->sin_family = AF_INET;
 199                 sin->sin_len = sizeof(struct sockaddr_in);
 200                 sin->sin_port = stcb->rport;
 201                 sin->sin_addr.s_addr = v4addr->addr;
 202                 if ((sin->sin_addr.s_addr == INADDR_BROADCAST) ||
 203                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 204                         bad_address = 1;
 205                 }
 206                 if (sin->sin_addr.s_addr == INADDR_ANY)
 207                         zero_address = 1;
 208                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 209                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 210                 break;
 211 #endif
 212 #ifdef INET6
 213         case SCTP_IPV6_ADDRESS:
 214                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 215                         /* invalid param size */
 216                         return (NULL);
 217                 }
 218                 v6addr = (struct sctp_ipv6addr_param *)ph;
 219                 sin6 = &store.sin6;
 220                 memset(sin6, 0, sizeof(*sin6));
 221                 sin6->sin6_family = AF_INET6;
 222                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 223                 sin6->sin6_port = stcb->rport;
 224                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 225                     sizeof(struct in6_addr));
 226                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 227                         bad_address = 1;
 228                 }
 229                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 230                         zero_address = 1;
 231                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_add_ip: adding ");
 232                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 233                 break;
 234 #endif
 235         default:
 236                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 237                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
 238                     aparam_length);
 239                 return (m_reply);
 240         }                       /* end switch */
 241
 242         /* if 0.0.0.0/::0, add the source address instead */
 243         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 244                 sa = src;
 245                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 246                     "process_asconf_add_ip: using source addr ");
 247                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 248         }
 249         net = NULL;
 250         /* add the address */
 251         if (bad_address) {
 252                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 253                     SCTP_CAUSE_INVALID_PARAM, (uint8_t *)aph,
 254                     aparam_length);
 255         } else if (sctp_add_remote_addr(stcb, sa, &net, stcb->asoc.port,
 256                     SCTP_DONOT_SETSCOPE,
 257             SCTP_ADDR_DYNAMIC_ADDED) != 0) {
 258                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 259                     "process_asconf_add_ip: error adding address\n");
 260                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 261                     SCTP_CAUSE_RESOURCE_SHORTAGE, (uint8_t *)aph,
 262                     aparam_length);
 263         } else {
 264                 if (response_required) {
 265                         m_reply =
 266                             sctp_asconf_success_response(aph->correlation_id);
 267                 }
 268                 if (net != NULL) {
 269                         /* notify upper layer */
 270                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_ADD_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 271                         sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb, net);
 272                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
 273                             stcb, net);
 274                         if (send_hb) {
 275                                 sctp_send_hb(stcb, net, SCTP_SO_NOT_LOCKED);
 276                         }
 277                 }
 278         }
 279         return (m_reply);
 280 }
 281
 282 static int
 283 sctp_asconf_del_remote_addrs_except(struct sctp_tcb *stcb, struct sockaddr *src)
 284 {
 285         struct sctp_nets *src_net, *net, *nnet;
 286
 287         /* make sure the source address exists as a destination net */
 288         src_net = sctp_findnet(stcb, src);
 289         if (src_net == NULL) {
 290                 /* not found */
 291                 return (-1);
 292         }
 293
 294         /* delete all destination addresses except the source */
 295         TAILQ_FOREACH_SAFE(net, &stcb->asoc.nets, sctp_next, nnet) {
 296                 if (net != src_net) {
 297                         /* delete this address */
 298                         SCTPDBG(SCTP_DEBUG_ASCONF1,
 299                             "asconf_del_remote_addrs_except: deleting ");
 300                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1,
 301                             (struct sockaddr *)&net->ro._l_addr);
 302                         /* notify upper layer */
 303                         sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0,
 304                             (struct sockaddr *)&net->ro._l_addr, SCTP_SO_NOT_LOCKED);
 305                         sctp_remove_net(stcb, net);
 306                 }
 307         }
 308         return (0);
 309 }
 310
 311 static struct mbuf *
 312 sctp_process_asconf_delete_ip(struct sockaddr *src,
 313     struct sctp_asconf_paramhdr *aph,
 314     struct sctp_tcb *stcb, int response_required)
 315 {
 316         struct mbuf *m_reply = NULL;
 317         union sctp_sockstore store;
 318         struct sctp_paramhdr *ph;
 319         uint16_t param_type, aparam_length;
 320 #if defined(INET) || defined(INET6)
 321         uint16_t param_length;
 322 #endif
 323         struct sockaddr *sa;
 324         int zero_address = 0;
 325         int result;
 326 #ifdef INET
 327         struct sockaddr_in *sin;
 328         struct sctp_ipv4addr_param *v4addr;
 329 #endif
 330 #ifdef INET6
 331         struct sockaddr_in6 *sin6;
 332         struct sctp_ipv6addr_param *v6addr;
 333 #endif
 334
 335         aparam_length = ntohs(aph->ph.param_length);
 336         if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
 337                 return (NULL);
 338         }
 339         ph = (struct sctp_paramhdr *)(aph + 1);
 340         param_type = ntohs(ph->param_type);
 341 #if defined(INET) || defined(INET6)
 342         param_length = ntohs(ph->param_length);
 343         if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
 344                 return (NULL);
 345         }
 346 #endif
 347         sa = &store.sa;
 348         switch (param_type) {
 349 #ifdef INET
 350         case SCTP_IPV4_ADDRESS:
 351                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 352                         /* invalid param size */
 353                         return (NULL);
 354                 }
 355                 v4addr = (struct sctp_ipv4addr_param *)ph;
 356                 sin = &store.sin;
 357                 memset(sin, 0, sizeof(*sin));
 358                 sin->sin_family = AF_INET;
 359                 sin->sin_len = sizeof(struct sockaddr_in);
 360                 sin->sin_port = stcb->rport;
 361                 sin->sin_addr.s_addr = v4addr->addr;
 362                 if (sin->sin_addr.s_addr == INADDR_ANY)
 363                         zero_address = 1;
 364                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 365                     "process_asconf_delete_ip: deleting ");
 366                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 367                 break;
 368 #endif
 369 #ifdef INET6
 370         case SCTP_IPV6_ADDRESS:
 371                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 372                         /* invalid param size */
 373                         return (NULL);
 374                 }
 375                 v6addr = (struct sctp_ipv6addr_param *)ph;
 376                 sin6 = &store.sin6;
 377                 memset(sin6, 0, sizeof(*sin6));
 378                 sin6->sin6_family = AF_INET6;
 379                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 380                 sin6->sin6_port = stcb->rport;
 381                 memcpy(&sin6->sin6_addr, v6addr->addr,
 382                     sizeof(struct in6_addr));
 383                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 384                         zero_address = 1;
 385                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 386                     "process_asconf_delete_ip: deleting ");
 387                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 388                 break;
 389 #endif
 390         default:
 391                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 392                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 393                     aparam_length);
 394                 return (m_reply);
 395         }
 396
 397         /* make sure the source address is not being deleted */
 398         if (sctp_cmpaddr(sa, src)) {
 399                 /* trying to delete the source address! */
 400                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete source addr\n");
 401                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 402                     SCTP_CAUSE_DELETING_SRC_ADDR, (uint8_t *)aph,
 403                     aparam_length);
 404                 return (m_reply);
 405         }
 406
 407         /* if deleting 0.0.0.0/::0, delete all addresses except src addr */
 408         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 409                 result = sctp_asconf_del_remote_addrs_except(stcb, src);
 410
 411                 if (result) {
 412                         /* src address did not exist? */
 413                         SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: src addr does not exist?\n");
 414                         /* what error to reply with?? */
 415                         m_reply =
 416                             sctp_asconf_error_response(aph->correlation_id,
 417                             SCTP_CAUSE_REQUEST_REFUSED, (uint8_t *)aph,
 418                             aparam_length);
 419                 } else if (response_required) {
 420                         m_reply =
 421                             sctp_asconf_success_response(aph->correlation_id);
 422                 }
 423                 return (m_reply);
 424         }
 425
 426         /* delete the address */
 427         result = sctp_del_remote_addr(stcb, sa);
 428         /*
 429          * note if result == -2, the address doesn't exist in the asoc but
 430          * since it's being deleted anyways, we just ack the delete -- but
 431          * this probably means something has already gone awry
 432          */
 433         if (result == -1) {
 434                 /* only one address in the asoc */
 435                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_delete_ip: tried to delete last IP addr!\n");
 436                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 437                     SCTP_CAUSE_DELETING_LAST_ADDR, (uint8_t *)aph,
 438                     aparam_length);
 439         } else {
 440                 if (response_required) {
 441                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 442                 }
 443                 /* notify upper layer */
 444                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_DELETE_IP, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 445         }
 446         return (m_reply);
 447 }
 448
 449 static struct mbuf *
 450 sctp_process_asconf_set_primary(struct sockaddr *src,
 451     struct sctp_asconf_paramhdr *aph,
 452     struct sctp_tcb *stcb, int response_required)
 453 {
 454         struct mbuf *m_reply = NULL;
 455         union sctp_sockstore store;
 456         struct sctp_paramhdr *ph;
 457         uint16_t param_type, aparam_length;
 458 #if defined(INET) || defined(INET6)
 459         uint16_t param_length;
 460 #endif
 461         struct sockaddr *sa;
 462         int zero_address = 0;
 463 #ifdef INET
 464         struct sockaddr_in *sin;
 465         struct sctp_ipv4addr_param *v4addr;
 466 #endif
 467 #ifdef INET6
 468         struct sockaddr_in6 *sin6;
 469         struct sctp_ipv6addr_param *v6addr;
 470 #endif
 471
 472         aparam_length = ntohs(aph->ph.param_length);
 473         if (aparam_length < sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_paramhdr)) {
 474                 return (NULL);
 475         }
 476         ph = (struct sctp_paramhdr *)(aph + 1);
 477         param_type = ntohs(ph->param_type);
 478 #if defined(INET) || defined(INET6)
 479         param_length = ntohs(ph->param_length);
 480         if (param_length + sizeof(struct sctp_asconf_paramhdr) != aparam_length) {
 481                 return (NULL);
 482         }
 483 #endif
 484         sa = &store.sa;
 485         switch (param_type) {
 486 #ifdef INET
 487         case SCTP_IPV4_ADDRESS:
 488                 if (param_length != sizeof(struct sctp_ipv4addr_param)) {
 489                         /* invalid param size */
 490                         return (NULL);
 491                 }
 492                 v4addr = (struct sctp_ipv4addr_param *)ph;
 493                 sin = &store.sin;
 494                 memset(sin, 0, sizeof(*sin));
 495                 sin->sin_family = AF_INET;
 496                 sin->sin_len = sizeof(struct sockaddr_in);
 497                 sin->sin_addr.s_addr = v4addr->addr;
 498                 if (sin->sin_addr.s_addr == INADDR_ANY)
 499                         zero_address = 1;
 500                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 501                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 502                 break;
 503 #endif
 504 #ifdef INET6
 505         case SCTP_IPV6_ADDRESS:
 506                 if (param_length != sizeof(struct sctp_ipv6addr_param)) {
 507                         /* invalid param size */
 508                         return (NULL);
 509                 }
 510                 v6addr = (struct sctp_ipv6addr_param *)ph;
 511                 sin6 = &store.sin6;
 512                 memset(sin6, 0, sizeof(*sin6));
 513                 sin6->sin6_family = AF_INET6;
 514                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 515                 memcpy((caddr_t)&sin6->sin6_addr, v6addr->addr,
 516                     sizeof(struct in6_addr));
 517                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 518                         zero_address = 1;
 519                 SCTPDBG(SCTP_DEBUG_ASCONF1, "process_asconf_set_primary: ");
 520                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
 521                 break;
 522 #endif
 523         default:
 524                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 525                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 526                     aparam_length);
 527                 return (m_reply);
 528         }
 529
 530         /* if 0.0.0.0/::0, use the source address instead */
 531         if (zero_address && SCTP_BASE_SYSCTL(sctp_nat_friendly)) {
 532                 sa = src;
 533                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 534                     "process_asconf_set_primary: using source addr ");
 535                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 536         }
 537         /* set the primary address */
 538         if (sctp_set_primary_addr(stcb, sa, NULL) == 0) {
 539                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 540                     "process_asconf_set_primary: primary address set\n");
 541                 /* notify upper layer */
 542                 sctp_ulp_notify(SCTP_NOTIFY_ASCONF_SET_PRIMARY, stcb, 0, sa, SCTP_SO_NOT_LOCKED);
 543                 if ((stcb->asoc.primary_destination->dest_state & SCTP_ADDR_REACHABLE) &&
 544                     (!(stcb->asoc.primary_destination->dest_state & SCTP_ADDR_PF)) &&
 545                     (stcb->asoc.alternate)) {
 546                         sctp_free_remote_addr(stcb->asoc.alternate);
 547                         stcb->asoc.alternate = NULL;
 548                 }
 549                 if (response_required) {
 550                         m_reply = sctp_asconf_success_response(aph->correlation_id);
 551                 }
 552                 /*
 553                  * Mobility adaptation. Ideally, when the reception of SET
 554                  * PRIMARY with DELETE IP ADDRESS of the previous primary
 555                  * destination, unacknowledged DATA are retransmitted
 556                  * immediately to the new primary destination for seamless
 557                  * handover. If the destination is UNCONFIRMED and marked to
 558                  * REQ_PRIM, The retransmission occur when reception of the
 559                  * HEARTBEAT-ACK.  (See sctp_handle_heartbeat_ack in
 560                  * sctp_input.c) Also, when change of the primary
 561                  * destination, it is better that all subsequent new DATA
 562                  * containing already queued DATA are transmitted to the new
 563                  * primary destination. (by micchie)
 564                  */
 565                 if ((sctp_is_mobility_feature_on(stcb->sctp_ep,
 566                     SCTP_MOBILITY_BASE) ||
 567                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 568                     SCTP_MOBILITY_FASTHANDOFF)) &&
 569                     sctp_is_mobility_feature_on(stcb->sctp_ep,
 570                     SCTP_MOBILITY_PRIM_DELETED) &&
 571                     (stcb->asoc.primary_destination->dest_state &
 572                     SCTP_ADDR_UNCONFIRMED) == 0) {
 573
 574                         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED,
 575                             stcb->sctp_ep, stcb, NULL,
 576                             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_1);
 577                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 578                             SCTP_MOBILITY_FASTHANDOFF)) {
 579                                 sctp_assoc_immediate_retrans(stcb,
 580                                     stcb->asoc.primary_destination);
 581                         }
 582                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
 583                             SCTP_MOBILITY_BASE)) {
 584                                 sctp_move_chunks_from_net(stcb,
 585                                     stcb->asoc.deleted_primary);
 586                         }
 587                         sctp_delete_prim_timer(stcb->sctp_ep, stcb);
 588                 }
 589         } else {
 590                 /* couldn't set the requested primary address! */
 591                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 592                     "process_asconf_set_primary: set primary failed!\n");
 593                 /* must have been an invalid address, so report */
 594                 m_reply = sctp_asconf_error_response(aph->correlation_id,
 595                     SCTP_CAUSE_UNRESOLVABLE_ADDR, (uint8_t *)aph,
 596                     aparam_length);
 597         }
 598
 599         return (m_reply);
 600 }
 601
 602 /*
 603  * handles an ASCONF chunk.
 604  * if all parameters are processed ok, send a plain (empty) ASCONF-ACK
 605  */
 606 void
 607 sctp_handle_asconf(struct mbuf *m, unsigned int offset,
 608     struct sockaddr *src,
 609     struct sctp_asconf_chunk *cp, struct sctp_tcb *stcb,
 610     int first)
 611 {
 612         struct sctp_association *asoc;
 613         uint32_t serial_num;
 614         struct mbuf *n, *m_ack, *m_result, *m_tail;
 615         struct sctp_asconf_ack_chunk *ack_cp;
 616         struct sctp_asconf_paramhdr *aph;
 617         struct sctp_ipv6addr_param *p_addr;
 618         unsigned int asconf_limit, cnt;
 619         int error = 0;          /* did an error occur? */
 620
 621         /* asconf param buffer */
 622         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
 623         struct sctp_asconf_ack *ack, *ack_next;
 624
 625         /* verify minimum length */
 626         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_chunk)) {
 627                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 628                     "handle_asconf: chunk too small = %xh\n",
 629                     ntohs(cp->ch.chunk_length));
 630                 return;
 631         }
 632         asoc = &stcb->asoc;
 633         serial_num = ntohl(cp->serial_number);
 634
 635         if (SCTP_TSN_GE(asoc->asconf_seq_in, serial_num)) {
 636                 /* got a duplicate ASCONF */
 637                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 638                     "handle_asconf: got duplicate serial number = %xh\n",
 639                     serial_num);
 640                 return;
 641         } else if (serial_num != (asoc->asconf_seq_in + 1)) {
 642                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: incorrect serial number = %xh (expected next = %xh)\n",
 643                     serial_num, asoc->asconf_seq_in + 1);
 644                 return;
 645         }
 646
 647         /* it's the expected "next" sequence number, so process it */
 648         asoc->asconf_seq_in = serial_num;       /* update sequence */
 649         /* get length of all the param's in the ASCONF */
 650         asconf_limit = offset + ntohs(cp->ch.chunk_length);
 651         SCTPDBG(SCTP_DEBUG_ASCONF1,
 652             "handle_asconf: asconf_limit=%u, sequence=%xh\n",
 653             asconf_limit, serial_num);
 654
 655         if (first) {
 656                 /* delete old cache */
 657                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: Now processing first ASCONF. Try to delete old cache\n");
 658
 659                 TAILQ_FOREACH_SAFE(ack, &asoc->asconf_ack_sent, next, ack_next) {
 660                         if (ack->serial_number == serial_num)
 661                                 break;
 662                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: delete old(%u) < first(%u)\n",
 663                             ack->serial_number, serial_num);
 664                         TAILQ_REMOVE(&asoc->asconf_ack_sent, ack, next);
 665                         if (ack->data != NULL) {
 666                                 sctp_m_freem(ack->data);
 667                         }
 668                         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), ack);
 669                 }
 670         }
 671
 672         m_ack = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_ack_chunk), 0,
 673             M_NOWAIT, 1, MT_DATA);
 674         if (m_ack == NULL) {
 675                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 676                     "handle_asconf: couldn't get mbuf!\n");
 677                 return;
 678         }
 679         m_tail = m_ack;         /* current reply chain's tail */
 680
 681         /* fill in ASCONF-ACK header */
 682         ack_cp = mtod(m_ack, struct sctp_asconf_ack_chunk *);
 683         ack_cp->ch.chunk_type = SCTP_ASCONF_ACK;
 684         ack_cp->ch.chunk_flags = 0;
 685         ack_cp->serial_number = htonl(serial_num);
 686         /* set initial lengths (eg. just an ASCONF-ACK), ntohx at the end! */
 687         SCTP_BUF_LEN(m_ack) = sizeof(struct sctp_asconf_ack_chunk);
 688         ack_cp->ch.chunk_length = sizeof(struct sctp_asconf_ack_chunk);
 689
 690         /* skip the lookup address parameter */
 691         offset += sizeof(struct sctp_asconf_chunk);
 692         p_addr = (struct sctp_ipv6addr_param *)sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr), (uint8_t *)&aparam_buf);
 693         if (p_addr == NULL) {
 694                 SCTPDBG(SCTP_DEBUG_ASCONF1,
 695                     "handle_asconf: couldn't get lookup addr!\n");
 696                 /* respond with a missing/invalid mandatory parameter error */
 697                 sctp_m_freem(m_ack);
 698                 return;
 699         }
 700         /* skip lookup addr */
 701         offset += SCTP_SIZE32(ntohs(p_addr->ph.param_length));
 702         /* get pointer to first asconf param in ASCONF */
 703         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, sizeof(struct sctp_asconf_paramhdr), (uint8_t *)&aparam_buf);
 704         if (aph == NULL) {
 705                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Empty ASCONF received?\n");
 706                 goto send_reply;
 707         }
 708         /* process through all parameters */
 709         cnt = 0;
 710         while (aph != NULL) {
 711                 unsigned int param_length, param_type;
 712
 713                 param_type = ntohs(aph->ph.param_type);
 714                 param_length = ntohs(aph->ph.param_length);
 715                 if (offset + param_length > asconf_limit) {
 716                         /* parameter goes beyond end of chunk! */
 717                         sctp_m_freem(m_ack);
 718                         return;
 719                 }
 720                 m_result = NULL;
 721
 722                 if (param_length > sizeof(aparam_buf)) {
 723                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) larger than buffer size!\n", param_length);
 724                         sctp_m_freem(m_ack);
 725                         return;
 726                 }
 727                 if (param_length <= sizeof(struct sctp_paramhdr)) {
 728                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: param length (%u) too short\n", param_length);
 729                         sctp_m_freem(m_ack);
 730                         return;
 731                 }
 732                 /* get the entire parameter */
 733                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
 734                 if (aph == NULL) {
 735                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: couldn't get entire param\n");
 736                         sctp_m_freem(m_ack);
 737                         return;
 738                 }
 739                 switch (param_type) {
 740                 case SCTP_ADD_IP_ADDRESS:
 741                         m_result = sctp_process_asconf_add_ip(src, aph, stcb,
 742                             (cnt < SCTP_BASE_SYSCTL(sctp_hb_maxburst)), error);
 743                         cnt++;
 744                         break;
 745                 case SCTP_DEL_IP_ADDRESS:
 746                         m_result = sctp_process_asconf_delete_ip(src, aph, stcb,
 747                             error);
 748                         break;
 749                 case SCTP_ERROR_CAUSE_IND:
 750                         /* not valid in an ASCONF chunk */
 751                         break;
 752                 case SCTP_SET_PRIM_ADDR:
 753                         m_result = sctp_process_asconf_set_primary(src, aph,
 754                             stcb, error);
 755                         break;
 756                 case SCTP_NAT_VTAGS:
 757                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: sees a NAT VTAG state parameter\n");
 758                         break;
 759                 case SCTP_SUCCESS_REPORT:
 760                         /* not valid in an ASCONF chunk */
 761                         break;
 762                 case SCTP_ULP_ADAPTATION:
 763                         /* FIX */
 764                         break;
 765                 default:
 766                         if ((param_type & 0x8000) == 0) {
 767                                 /* Been told to STOP at this param */
 768                                 asconf_limit = offset;
 769                                 /*
 770                                  * FIX FIX - We need to call
 771                                  * sctp_arethere_unrecognized_parameters()
 772                                  * to get a operr and send it for any
 773                                  * param's with the 0x4000 bit set OR do it
 774                                  * here ourselves... note we still must STOP
 775                                  * if the 0x8000 bit is clear.
 776                                  */
 777                         }
 778                         /* unknown/invalid param type */
 779                         break;
 780                 }               /* switch */
 781
 782                 /* add any (error) result to the reply mbuf chain */
 783                 if (m_result != NULL) {
 784                         SCTP_BUF_NEXT(m_tail) = m_result;
 785                         m_tail = m_result;
 786                         ack_cp->ch.chunk_length += SCTP_BUF_LEN(m_result);
 787                         /* set flag to force success reports */
 788                         error = 1;
 789                 }
 790                 offset += SCTP_SIZE32(param_length);
 791                 /* update remaining ASCONF message length to process */
 792                 if (offset >= asconf_limit) {
 793                         /* no more data in the mbuf chain */
 794                         break;
 795                 }
 796                 /* get pointer to next asconf param */
 797                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
 798                     sizeof(struct sctp_asconf_paramhdr),
 799                     (uint8_t *)&aparam_buf);
 800                 if (aph == NULL) {
 801                         /* can't get an asconf paramhdr */
 802                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: can't get asconf param hdr!\n");
 803                         /* FIX ME - add error here... */
 804                 }
 805         }
 806
 807 send_reply:
 808         ack_cp->ch.chunk_length = htons(ack_cp->ch.chunk_length);
 809         /* save the ASCONF-ACK reply */
 810         ack = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asconf_ack),
 811             struct sctp_asconf_ack);
 812         if (ack == NULL) {
 813                 sctp_m_freem(m_ack);
 814                 return;
 815         }
 816         ack->serial_number = serial_num;
 817         ack->last_sent_to = NULL;
 818         ack->data = m_ack;
 819         ack->len = 0;
 820         for (n = m_ack; n != NULL; n = SCTP_BUF_NEXT(n)) {
 821                 ack->len += SCTP_BUF_LEN(n);
 822         }
 823         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_ack_sent, ack, next);
 824
 825         /* see if last_control_chunk_from is set properly (use IP src addr) */
 826         if (stcb->asoc.last_control_chunk_from == NULL) {
 827                 /*
 828                  * this could happen if the source address was just newly
 829                  * added
 830                  */
 831                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: looking up net for IP source address\n");
 832                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Looking for IP source: ");
 833                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, src);
 834                 /* look up the from address */
 835                 stcb->asoc.last_control_chunk_from = sctp_findnet(stcb, src);
 836 #ifdef SCTP_DEBUG
 837                 if (stcb->asoc.last_control_chunk_from == NULL) {
 838                         SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf: IP source address not found?!\n");
 839                 }
 840 #endif
 841         }
 842 }
 843
 844 /*
 845  * does the address match? returns 0 if not, 1 if so
 846  */
 847 static uint32_t
 848 sctp_asconf_addr_match(struct sctp_asconf_addr *aa, struct sockaddr *sa)
 849 {
 850         switch (sa->sa_family) {
 851 #ifdef INET6
 852         case AF_INET6:
 853                 {
 854                         /* XXX scopeid */
 855                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 856
 857                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) &&
 858                             (memcmp(&aa->ap.addrp.addr, &sin6->sin6_addr,
 859                             sizeof(struct in6_addr)) == 0)) {
 860                                 return (1);
 861                         }
 862                         break;
 863                 }
 864 #endif
 865 #ifdef INET
 866         case AF_INET:
 867                 {
 868                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 869
 870                         if ((aa->ap.addrp.ph.param_type == SCTP_IPV4_ADDRESS) &&
 871                             (memcmp(&aa->ap.addrp.addr, &sin->sin_addr,
 872                             sizeof(struct in_addr)) == 0)) {
 873                                 return (1);
 874                         }
 875                         break;
 876                 }
 877 #endif
 878         default:
 879                 break;
 880         }
 881         return (0);
 882 }
 883
 884 /*
 885  * does the address match? returns 0 if not, 1 if so
 886  */
 887 static uint32_t
 888 sctp_addr_match(struct sctp_paramhdr *ph, struct sockaddr *sa)
 889 {
 890 #if defined(INET) || defined(INET6)
 891         uint16_t param_type, param_length;
 892
 893         param_type = ntohs(ph->param_type);
 894         param_length = ntohs(ph->param_length);
 895 #endif
 896         switch (sa->sa_family) {
 897 #ifdef INET6
 898         case AF_INET6:
 899                 {
 900                         /* XXX scopeid */
 901                         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa;
 902                         struct sctp_ipv6addr_param *v6addr;
 903
 904                         v6addr = (struct sctp_ipv6addr_param *)ph;
 905                         if ((param_type == SCTP_IPV6_ADDRESS) &&
 906                             (param_length == sizeof(struct sctp_ipv6addr_param)) &&
 907                             (memcmp(&v6addr->addr, &sin6->sin6_addr,
 908                             sizeof(struct in6_addr)) == 0)) {
 909                                 return (1);
 910                         }
 911                         break;
 912                 }
 913 #endif
 914 #ifdef INET
 915         case AF_INET:
 916                 {
 917                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
 918                         struct sctp_ipv4addr_param *v4addr;
 919
 920                         v4addr = (struct sctp_ipv4addr_param *)ph;
 921                         if ((param_type == SCTP_IPV4_ADDRESS) &&
 922                             (param_length == sizeof(struct sctp_ipv4addr_param)) &&
 923                             (memcmp(&v4addr->addr, &sin->sin_addr,
 924                             sizeof(struct in_addr)) == 0)) {
 925                                 return (1);
 926                         }
 927                         break;
 928                 }
 929 #endif
 930         default:
 931                 break;
 932         }
 933         return (0);
 934 }
 935
 936 /*
 937  * Cleanup for non-responded/OP ERR'd ASCONF
 938  */
 939 void
 940 sctp_asconf_cleanup(struct sctp_tcb *stcb)
 941 {
 942         /*
 943          * clear out any existing asconfs going out
 944          */
 945         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, NULL,
 946             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_2);
 947         stcb->asoc.asconf_seq_out_acked = stcb->asoc.asconf_seq_out;
 948         /* remove the old ASCONF on our outbound queue */
 949         sctp_toss_old_asconf(stcb);
 950 }
 951
 952 /*
 953  * cleanup any cached source addresses that may be topologically
 954  * incorrect after a new address has been added to this interface.
 955  */
 956 static void
 957 sctp_asconf_nets_cleanup(struct sctp_tcb *stcb, struct sctp_ifn *ifn)
 958 {
 959         struct sctp_nets *net;
 960
 961         /*
 962          * Ideally, we want to only clear cached routes and source addresses
 963          * that are topologically incorrect.  But since there is no easy way
 964          * to know whether the newly added address on the ifn would cause a
 965          * routing change (i.e. a new egress interface would be chosen)
 966          * without doing a new routing lookup and source address selection,
 967          * we will (for now) just flush any cached route using a different
 968          * ifn (and cached source addrs) and let output re-choose them
 969          * during the next send on that net.
 970          */
 971         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 972                 /*
 973                  * clear any cached route (and cached source address) if the
 974                  * route's interface is NOT the same as the address change.
 975                  * If it's the same interface, just clear the cached source
 976                  * address.
 977                  */
 978                 if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro) &&
 979                     ((ifn == NULL) ||
 980                     (SCTP_GET_IF_INDEX_FROM_ROUTE(&net->ro) != ifn->ifn_index))) {
 981                         /* clear any cached route */
 982                         RTFREE(net->ro.ro_rt);
 983                         net->ro.ro_rt = NULL;
 984                 }
 985                 /* clear any cached source address */
 986                 if (net->src_addr_selected) {
 987                         sctp_free_ifa(net->ro._s_addr);
 988                         net->ro._s_addr = NULL;
 989                         net->src_addr_selected = 0;
 990                 }
 991         }
 992 }
 993
 994
 995 void
 996 sctp_assoc_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *dstnet)
 997 {
 998         int error;
 999
1000         if (dstnet->dest_state & SCTP_ADDR_UNCONFIRMED) {
1001                 return;
1002         }
1003         if (stcb->asoc.deleted_primary == NULL) {
1004                 return;
1005         }
1006
1007         if (!TAILQ_EMPTY(&stcb->asoc.sent_queue)) {
1008                 SCTPDBG(SCTP_DEBUG_ASCONF1, "assoc_immediate_retrans: Deleted primary is ");
1009                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.deleted_primary->ro._l_addr.sa);
1010                 SCTPDBG(SCTP_DEBUG_ASCONF1, "Current Primary is ");
1011                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, &stcb->asoc.primary_destination->ro._l_addr.sa);
1012                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb,
1013                     stcb->asoc.deleted_primary,
1014                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_3);
1015                 stcb->asoc.num_send_timers_up--;
1016                 if (stcb->asoc.num_send_timers_up < 0) {
1017                         stcb->asoc.num_send_timers_up = 0;
1018                 }
1019                 SCTP_TCB_LOCK_ASSERT(stcb);
1020                 error = sctp_t3rxt_timer(stcb->sctp_ep, stcb,
1021                     stcb->asoc.deleted_primary);
1022                 if (error) {
1023                         SCTP_INP_DECR_REF(stcb->sctp_ep);
1024                         return;
1025                 }
1026                 SCTP_TCB_LOCK_ASSERT(stcb);
1027 #ifdef SCTP_AUDITING_ENABLED
1028                 sctp_auditing(4, stcb->sctp_ep, stcb, stcb->asoc.deleted_primary);
1029 #endif
1030                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1031                 if ((stcb->asoc.num_send_timers_up == 0) &&
1032                     (stcb->asoc.sent_queue_cnt > 0)) {
1033                         struct sctp_tmit_chunk *chk;
1034
1035                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1036                                 if (chk->whoTo != NULL) {
1037                                         break;
1038                                 }
1039                         }
1040                         if (chk != NULL) {
1041                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
1042                         }
1043                 }
1044         }
1045         return;
1046 }
1047
1048 static int
1049     sctp_asconf_queue_mgmt(struct sctp_tcb *, struct sctp_ifa *, uint16_t);
1050
1051 void
1052 sctp_net_immediate_retrans(struct sctp_tcb *stcb, struct sctp_nets *net)
1053 {
1054         struct sctp_tmit_chunk *chk;
1055
1056         SCTPDBG(SCTP_DEBUG_ASCONF1, "net_immediate_retrans: RTO is %d\n", net->RTO);
1057         sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net,
1058             SCTP_FROM_SCTP_ASCONF + SCTP_LOC_4);
1059         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
1060         net->error_count = 0;
1061         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1062                 if (chk->whoTo == net) {
1063                         if (chk->sent < SCTP_DATAGRAM_RESEND) {
1064                                 chk->sent = SCTP_DATAGRAM_RESEND;
1065                                 sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
1066                                 sctp_flight_size_decrease(chk);
1067                                 sctp_total_flight_decrease(stcb, chk);
1068                                 net->marked_retrans++;
1069                                 stcb->asoc.marked_retrans++;
1070                         }
1071                 }
1072         }
1073         if (net->marked_retrans) {
1074                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1075         }
1076 }
1077
1078 static void
1079 sctp_path_check_and_react(struct sctp_tcb *stcb, struct sctp_ifa *newifa)
1080 {
1081         struct sctp_nets *net;
1082         int addrnum, changed;
1083
1084         /*
1085          * If number of local valid addresses is 1, the valid address is
1086          * probably newly added address. Several valid addresses in this
1087          * association.  A source address may not be changed.  Additionally,
1088          * they can be configured on a same interface as "alias" addresses.
1089          * (by micchie)
1090          */
1091         addrnum = sctp_local_addr_count(stcb);
1092         SCTPDBG(SCTP_DEBUG_ASCONF1, "p_check_react(): %d local addresses\n",
1093             addrnum);
1094         if (addrnum == 1) {
1095                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1096                         /* clear any cached route and source address */
1097                         if (net->ro.ro_rt) {
1098                                 RTFREE(net->ro.ro_rt);
1099                                 net->ro.ro_rt = NULL;
1100                         }
1101                         if (net->src_addr_selected) {
1102                                 sctp_free_ifa(net->ro._s_addr);
1103                                 net->ro._s_addr = NULL;
1104                                 net->src_addr_selected = 0;
1105                         }
1106                         /* Retransmit unacknowledged DATA chunks immediately */
1107                         if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1108                             SCTP_MOBILITY_FASTHANDOFF)) {
1109                                 sctp_net_immediate_retrans(stcb, net);
1110                         }
1111                         /* also, SET PRIMARY is maybe already sent */
1112                 }
1113                 return;
1114         }
1115
1116         /* Multiple local addresses exsist in the association.  */
1117         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1118                 /* clear any cached route and source address */
1119                 if (net->ro.ro_rt) {
1120                         RTFREE(net->ro.ro_rt);
1121                         net->ro.ro_rt = NULL;
1122                 }
1123                 if (net->src_addr_selected) {
1124                         sctp_free_ifa(net->ro._s_addr);
1125                         net->ro._s_addr = NULL;
1126                         net->src_addr_selected = 0;
1127                 }
1128                 /*
1129                  * Check if the nexthop is corresponding to the new address.
1130                  * If the new address is corresponding to the current
1131                  * nexthop, the path will be changed. If the new address is
1132                  * NOT corresponding to the current nexthop, the path will
1133                  * not be changed.
1134                  */
1135                 SCTP_RTALLOC((sctp_route_t *)&net->ro,
1136                     stcb->sctp_ep->def_vrf_id,
1137                     stcb->sctp_ep->fibnum);
1138                 if (net->ro.ro_rt == NULL)
1139                         continue;
1140
1141                 changed = 0;
1142                 switch (net->ro._l_addr.sa.sa_family) {
1143 #ifdef INET
1144                 case AF_INET:
1145                         if (sctp_v4src_match_nexthop(newifa, (sctp_route_t *)&net->ro)) {
1146                                 changed = 1;
1147                         }
1148                         break;
1149 #endif
1150 #ifdef INET6
1151                 case AF_INET6:
1152                         if (sctp_v6src_match_nexthop(
1153                             &newifa->address.sin6, (sctp_route_t *)&net->ro)) {
1154                                 changed = 1;
1155                         }
1156                         break;
1157 #endif
1158                 default:
1159                         break;
1160                 }
1161                 /*
1162                  * if the newly added address does not relate routing
1163                  * information, we skip.
1164                  */
1165                 if (changed == 0)
1166                         continue;
1167                 /* Retransmit unacknowledged DATA chunks immediately */
1168                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1169                     SCTP_MOBILITY_FASTHANDOFF)) {
1170                         sctp_net_immediate_retrans(stcb, net);
1171                 }
1172                 /* Send SET PRIMARY for this new address */
1173                 if (net == stcb->asoc.primary_destination) {
1174                         (void)sctp_asconf_queue_mgmt(stcb, newifa,
1175                             SCTP_SET_PRIM_ADDR);
1176                 }
1177         }
1178 }
1179
1180 /*
1181  * process an ADD/DELETE IP ack from peer.
1182  * addr: corresponding sctp_ifa to the address being added/deleted.
1183  * type: SCTP_ADD_IP_ADDRESS or SCTP_DEL_IP_ADDRESS.
1184  * flag: 1=success, 0=failure.
1185  */
1186 static void
1187 sctp_asconf_addr_mgmt_ack(struct sctp_tcb *stcb, struct sctp_ifa *addr, uint32_t flag)
1188 {
1189         /*
1190          * do the necessary asoc list work- if we get a failure indication,
1191          * leave the address on the assoc's restricted list.  If we get a
1192          * success indication, remove the address from the restricted list.
1193          */
1194         /*
1195          * Note: this will only occur for ADD_IP_ADDRESS, since
1196          * DEL_IP_ADDRESS is never actually added to the list...
1197          */
1198         if (flag) {
1199                 /* success case, so remove from the restricted list */
1200                 sctp_del_local_addr_restricted(stcb, addr);
1201
1202                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
1203                     SCTP_MOBILITY_BASE) ||
1204                     sctp_is_mobility_feature_on(stcb->sctp_ep,
1205                     SCTP_MOBILITY_FASTHANDOFF)) {
1206                         sctp_path_check_and_react(stcb, addr);
1207                         return;
1208                 }
1209                 /* clear any cached/topologically incorrect source addresses */
1210                 sctp_asconf_nets_cleanup(stcb, addr->ifn_p);
1211         }
1212         /* else, leave it on the list */
1213 }
1214
1215 /*
1216  * add an asconf add/delete/set primary IP address parameter to the queue.
1217  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1218  * returns 0 if queued, -1 if not queued/removed.
1219  * NOTE: if adding, but a delete for the same address is already scheduled
1220  * (and not yet sent out), simply remove it from queue.  Same for deleting
1221  * an address already scheduled for add.  If a duplicate operation is found,
1222  * ignore the new one.
1223  */
1224 static int
1225 sctp_asconf_queue_mgmt(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1226     uint16_t type)
1227 {
1228         struct sctp_asconf_addr *aa, *aa_next;
1229
1230         /* make sure the request isn't already in the queue */
1231         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1232                 /* address match? */
1233                 if (sctp_asconf_addr_match(aa, &ifa->address.sa) == 0)
1234                         continue;
1235                 /*
1236                  * is the request already in queue but not sent? pass the
1237                  * request already sent in order to resolve the following
1238                  * case: 1. arrival of ADD, then sent 2. arrival of DEL. we
1239                  * can't remove the ADD request already sent 3. arrival of
1240                  * ADD
1241                  */
1242                 if (aa->ap.aph.ph.param_type == type && aa->sent == 0) {
1243                         return (-1);
1244                 }
1245                 /* is the negative request already in queue, and not sent */
1246                 if ((aa->sent == 0) && (type == SCTP_ADD_IP_ADDRESS) &&
1247                     (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS)) {
1248                         /* add requested, delete already queued */
1249                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1250                         /* remove the ifa from the restricted list */
1251                         sctp_del_local_addr_restricted(stcb, ifa);
1252                         /* free the asconf param */
1253                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1254                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: add removes queued entry\n");
1255                         return (-1);
1256                 }
1257                 if ((aa->sent == 0) && (type == SCTP_DEL_IP_ADDRESS) &&
1258                     (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS)) {
1259                         /* delete requested, add already queued */
1260                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1261                         /* remove the aa->ifa from the restricted list */
1262                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1263                         /* free the asconf param */
1264                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1265                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_mgmt: delete removes queued entry\n");
1266                         return (-1);
1267                 }
1268         }                       /* for each aa */
1269
1270         /* adding new request to the queue */
1271         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1272             SCTP_M_ASC_ADDR);
1273         if (aa == NULL) {
1274                 /* didn't get memory */
1275                 SCTPDBG(SCTP_DEBUG_ASCONF1, "asconf_queue_mgmt: failed to get memory!\n");
1276                 return (-1);
1277         }
1278         aa->special_del = 0;
1279         /* fill in asconf address parameter fields */
1280         /* top level elements are "networked" during send */
1281         aa->ap.aph.ph.param_type = type;
1282         aa->ifa = ifa;
1283         atomic_add_int(&ifa->refcount, 1);
1284         /* correlation_id filled in during send routine later... */
1285         switch (ifa->address.sa.sa_family) {
1286 #ifdef INET6
1287         case AF_INET6:
1288                 {
1289                         struct sockaddr_in6 *sin6;
1290
1291                         sin6 = &ifa->address.sin6;
1292                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1293                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1294                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1295                             sizeof(struct sctp_ipv6addr_param);
1296                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1297                             sizeof(struct in6_addr));
1298                         break;
1299                 }
1300 #endif
1301 #ifdef INET
1302         case AF_INET:
1303                 {
1304                         struct sockaddr_in *sin;
1305
1306                         sin = &ifa->address.sin;
1307                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1308                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1309                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) +
1310                             sizeof(struct sctp_ipv4addr_param);
1311                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1312                             sizeof(struct in_addr));
1313                         break;
1314                 }
1315 #endif
1316         default:
1317                 /* invalid family! */
1318                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1319                 sctp_free_ifa(ifa);
1320                 return (-1);
1321         }
1322         aa->sent = 0;           /* clear sent flag */
1323
1324         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1325 #ifdef SCTP_DEBUG
1326         if (SCTP_BASE_SYSCTL(sctp_debug_on) & SCTP_DEBUG_ASCONF2) {
1327                 if (type == SCTP_ADD_IP_ADDRESS) {
1328                         SCTP_PRINTF("asconf_queue_mgmt: inserted asconf ADD_IP_ADDRESS: ");
1329                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1330                 } else if (type == SCTP_DEL_IP_ADDRESS) {
1331                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf DEL_IP_ADDRESS: ");
1332                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1333                 } else {
1334                         SCTP_PRINTF("asconf_queue_mgmt: appended asconf SET_PRIM_ADDR: ");
1335                         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, &ifa->address.sa);
1336                 }
1337         }
1338 #endif
1339
1340         return (0);
1341 }
1342
1343
1344 /*
1345  * add an asconf operation for the given ifa and type.
1346  * type = SCTP_ADD_IP_ADDRESS, SCTP_DEL_IP_ADDRESS, SCTP_SET_PRIM_ADDR.
1347  * returns 0 if completed, -1 if not completed, 1 if immediate send is
1348  * advisable.
1349  */
1350 static int
1351 sctp_asconf_queue_add(struct sctp_tcb *stcb, struct sctp_ifa *ifa,
1352     uint16_t type)
1353 {
1354         uint32_t status;
1355         int pending_delete_queued = 0;
1356         int last;
1357
1358         /* see if peer supports ASCONF */
1359         if (stcb->asoc.asconf_supported == 0) {
1360                 return (-1);
1361         }
1362
1363         /*
1364          * if this is deleting the last address from the assoc, mark it as
1365          * pending.
1366          */
1367         if ((type == SCTP_DEL_IP_ADDRESS) && !stcb->asoc.asconf_del_pending) {
1368                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1369                         last = (sctp_local_addr_count(stcb) == 0);
1370                 } else {
1371                         last = (sctp_local_addr_count(stcb) == 1);
1372                 }
1373                 if (last) {
1374                         /* set the pending delete info only */
1375                         stcb->asoc.asconf_del_pending = 1;
1376                         stcb->asoc.asconf_addr_del_pending = ifa;
1377                         atomic_add_int(&ifa->refcount, 1);
1378                         SCTPDBG(SCTP_DEBUG_ASCONF2,
1379                             "asconf_queue_add: mark delete last address pending\n");
1380                         return (-1);
1381                 }
1382         }
1383
1384         /* queue an asconf parameter */
1385         status = sctp_asconf_queue_mgmt(stcb, ifa, type);
1386
1387         /*
1388          * if this is an add, and there is a delete also pending (i.e. the
1389          * last local address is being changed), queue the pending delete
1390          * too.
1391          */
1392         if ((type == SCTP_ADD_IP_ADDRESS) && stcb->asoc.asconf_del_pending && (status == 0)) {
1393                 /* queue in the pending delete */
1394                 if (sctp_asconf_queue_mgmt(stcb,
1395                     stcb->asoc.asconf_addr_del_pending,
1396                     SCTP_DEL_IP_ADDRESS) == 0) {
1397                         SCTPDBG(SCTP_DEBUG_ASCONF2, "asconf_queue_add: queuing pending delete\n");
1398                         pending_delete_queued = 1;
1399                         /* clear out the pending delete info */
1400                         stcb->asoc.asconf_del_pending = 0;
1401                         sctp_free_ifa(stcb->asoc.asconf_addr_del_pending);
1402                         stcb->asoc.asconf_addr_del_pending = NULL;
1403                 }
1404         }
1405
1406         if (pending_delete_queued) {
1407                 struct sctp_nets *net;
1408
1409                 /*
1410                  * since we know that the only/last address is now being
1411                  * changed in this case, reset the cwnd/rto on all nets to
1412                  * start as a new address and path.  Also clear the error
1413                  * counts to give the assoc the best chance to complete the
1414                  * address change.
1415                  */
1416                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1417                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb,
1418                             net);
1419                         net->RTO = 0;
1420                         net->error_count = 0;
1421                 }
1422                 stcb->asoc.overall_error_count = 0;
1423                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
1424                         sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
1425                             stcb->asoc.overall_error_count,
1426                             0,
1427                             SCTP_FROM_SCTP_ASCONF,
1428                             __LINE__);
1429                 }
1430
1431                 /* queue in an advisory set primary too */
1432                 (void)sctp_asconf_queue_mgmt(stcb, ifa, SCTP_SET_PRIM_ADDR);
1433                 /* let caller know we should send this out immediately */
1434                 status = 1;
1435         }
1436         return (status);
1437 }
1438
1439 /*-
1440  * add an asconf delete IP address parameter to the queue by sockaddr and
1441  * possibly with no sctp_ifa available.  This is only called by the routine
1442  * that checks the addresses in an INIT-ACK against the current address list.
1443  * returns 0 if completed, non-zero if not completed.
1444  * NOTE: if an add is already scheduled (and not yet sent out), simply
1445  * remove it from queue.  If a duplicate operation is found, ignore the
1446  * new one.
1447  */
1448 static int
1449 sctp_asconf_queue_sa_delete(struct sctp_tcb *stcb, struct sockaddr *sa)
1450 {
1451         struct sctp_ifa *ifa;
1452         struct sctp_asconf_addr *aa, *aa_next;
1453
1454         if (stcb == NULL) {
1455                 return (-1);
1456         }
1457         /* see if peer supports ASCONF */
1458         if (stcb->asoc.asconf_supported == 0) {
1459                 return (-1);
1460         }
1461         /* make sure the request isn't already in the queue */
1462         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1463                 /* address match? */
1464                 if (sctp_asconf_addr_match(aa, sa) == 0)
1465                         continue;
1466                 /* is the request already in queue (sent or not) */
1467                 if (aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
1468                         return (-1);
1469                 }
1470                 /* is the negative request already in queue, and not sent */
1471                 if (aa->sent == 1)
1472                         continue;
1473                 if (aa->ap.aph.ph.param_type == SCTP_ADD_IP_ADDRESS) {
1474                         /* add already queued, so remove existing entry */
1475                         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aa, next);
1476                         sctp_del_local_addr_restricted(stcb, aa->ifa);
1477                         /* free the entry */
1478                         SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1479                         return (-1);
1480                 }
1481         }                       /* for each aa */
1482
1483         /* find any existing ifa-- NOTE ifa CAN be allowed to be NULL */
1484         ifa = sctp_find_ifa_by_addr(sa, stcb->asoc.vrf_id, SCTP_ADDR_NOT_LOCKED);
1485
1486         /* adding new request to the queue */
1487         SCTP_MALLOC(aa, struct sctp_asconf_addr *, sizeof(*aa),
1488             SCTP_M_ASC_ADDR);
1489         if (aa == NULL) {
1490                 /* didn't get memory */
1491                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1492                     "sctp_asconf_queue_sa_delete: failed to get memory!\n");
1493                 return (-1);
1494         }
1495         aa->special_del = 0;
1496         /* fill in asconf address parameter fields */
1497         /* top level elements are "networked" during send */
1498         aa->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
1499         aa->ifa = ifa;
1500         if (ifa)
1501                 atomic_add_int(&ifa->refcount, 1);
1502         /* correlation_id filled in during send routine later... */
1503         switch (sa->sa_family) {
1504 #ifdef INET6
1505         case AF_INET6:
1506                 {
1507                         /* IPv6 address */
1508                         struct sockaddr_in6 *sin6;
1509
1510                         sin6 = (struct sockaddr_in6 *)sa;
1511                         aa->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
1512                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv6addr_param));
1513                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv6addr_param);
1514                         memcpy(&aa->ap.addrp.addr, &sin6->sin6_addr,
1515                             sizeof(struct in6_addr));
1516                         break;
1517                 }
1518 #endif
1519 #ifdef INET
1520         case AF_INET:
1521                 {
1522                         /* IPv4 address */
1523                         struct sockaddr_in *sin = (struct sockaddr_in *)sa;
1524
1525                         aa->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
1526                         aa->ap.addrp.ph.param_length = (sizeof(struct sctp_ipv4addr_param));
1527                         aa->ap.aph.ph.param_length = sizeof(struct sctp_asconf_paramhdr) + sizeof(struct sctp_ipv4addr_param);
1528                         memcpy(&aa->ap.addrp.addr, &sin->sin_addr,
1529                             sizeof(struct in_addr));
1530                         break;
1531                 }
1532 #endif
1533         default:
1534                 /* invalid family! */
1535                 SCTP_FREE(aa, SCTP_M_ASC_ADDR);
1536                 if (ifa)
1537                         sctp_free_ifa(ifa);
1538                 return (-1);
1539         }
1540         aa->sent = 0;           /* clear sent flag */
1541
1542         /* delete goes to the back of the queue */
1543         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa, next);
1544
1545         /* sa_ignore MEMLEAK {memory is put on the tailq} */
1546         return (0);
1547 }
1548
1549 /*
1550  * find a specific asconf param on our "sent" queue
1551  */
1552 static struct sctp_asconf_addr *
1553 sctp_asconf_find_param(struct sctp_tcb *stcb, uint32_t correlation_id)
1554 {
1555         struct sctp_asconf_addr *aa;
1556
1557         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
1558                 if (aa->ap.aph.correlation_id == correlation_id &&
1559                     aa->sent == 1) {
1560                         /* found it */
1561                         return (aa);
1562                 }
1563         }
1564         /* didn't find it */
1565         return (NULL);
1566 }
1567
1568 /*
1569  * process an SCTP_ERROR_CAUSE_IND for a ASCONF-ACK parameter and do
1570  * notifications based on the error response
1571  */
1572 static void
1573 sctp_asconf_process_error(struct sctp_tcb *stcb SCTP_UNUSED,
1574     struct sctp_asconf_paramhdr *aph)
1575 {
1576         struct sctp_error_cause *eh;
1577         struct sctp_paramhdr *ph;
1578         uint16_t param_type;
1579         uint16_t error_code;
1580
1581         eh = (struct sctp_error_cause *)(aph + 1);
1582         ph = (struct sctp_paramhdr *)(eh + 1);
1583         /* validate lengths */
1584         if (htons(eh->length) + sizeof(struct sctp_error_cause) >
1585             htons(aph->ph.param_length)) {
1586                 /* invalid error cause length */
1587                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1588                     "asconf_process_error: cause element too long\n");
1589                 return;
1590         }
1591         if (htons(ph->param_length) + sizeof(struct sctp_paramhdr) >
1592             htons(eh->length)) {
1593                 /* invalid included TLV length */
1594                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1595                     "asconf_process_error: included TLV too long\n");
1596                 return;
1597         }
1598         /* which error code ? */
1599         error_code = ntohs(eh->code);
1600         param_type = ntohs(aph->ph.param_type);
1601         /* FIX: this should go back up the REMOTE_ERROR ULP notify */
1602         switch (error_code) {
1603         case SCTP_CAUSE_RESOURCE_SHORTAGE:
1604                 /* we allow ourselves to "try again" for this error */
1605                 break;
1606         default:
1607                 /* peer can't handle it... */
1608                 switch (param_type) {
1609                 case SCTP_ADD_IP_ADDRESS:
1610                 case SCTP_DEL_IP_ADDRESS:
1611                 case SCTP_SET_PRIM_ADDR:
1612                         break;
1613                 default:
1614                         break;
1615                 }
1616         }
1617 }
1618
1619 /*
1620  * process an asconf queue param.
1621  * aparam: parameter to process, will be removed from the queue.
1622  * flag: 1=success case, 0=failure case
1623  */
1624 static void
1625 sctp_asconf_process_param_ack(struct sctp_tcb *stcb,
1626     struct sctp_asconf_addr *aparam, uint32_t flag)
1627 {
1628         uint16_t param_type;
1629
1630         /* process this param */
1631         param_type = aparam->ap.aph.ph.param_type;
1632         switch (param_type) {
1633         case SCTP_ADD_IP_ADDRESS:
1634                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1635                     "process_param_ack: added IP address\n");
1636                 sctp_asconf_addr_mgmt_ack(stcb, aparam->ifa, flag);
1637                 break;
1638         case SCTP_DEL_IP_ADDRESS:
1639                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1640                     "process_param_ack: deleted IP address\n");
1641                 /* nothing really to do... lists already updated */
1642                 break;
1643         case SCTP_SET_PRIM_ADDR:
1644                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1645                     "process_param_ack: set primary IP address\n");
1646                 /* nothing to do... peer may start using this addr */
1647                 break;
1648         default:
1649                 /* should NEVER happen */
1650                 break;
1651         }
1652
1653         /* remove the param and free it */
1654         TAILQ_REMOVE(&stcb->asoc.asconf_queue, aparam, next);
1655         if (aparam->ifa)
1656                 sctp_free_ifa(aparam->ifa);
1657         SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
1658 }
1659
1660 /*
1661  * cleanup from a bad asconf ack parameter
1662  */
1663 static void
1664 sctp_asconf_ack_clear(struct sctp_tcb *stcb SCTP_UNUSED)
1665 {
1666         /* assume peer doesn't really know how to do asconfs */
1667         /* XXX we could free the pending queue here */
1668
1669 }
1670
1671 void
1672 sctp_handle_asconf_ack(struct mbuf *m, int offset,
1673     struct sctp_asconf_ack_chunk *cp, struct sctp_tcb *stcb,
1674     struct sctp_nets *net, int *abort_no_unlock)
1675 {
1676         struct sctp_association *asoc;
1677         uint32_t serial_num;
1678         uint16_t ack_length;
1679         struct sctp_asconf_paramhdr *aph;
1680         struct sctp_asconf_addr *aa, *aa_next;
1681         uint32_t last_error_id = 0;     /* last error correlation id */
1682         uint32_t id;
1683         struct sctp_asconf_addr *ap;
1684
1685         /* asconf param buffer */
1686         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
1687
1688         /* verify minimum length */
1689         if (ntohs(cp->ch.chunk_length) < sizeof(struct sctp_asconf_ack_chunk)) {
1690                 SCTPDBG(SCTP_DEBUG_ASCONF1,
1691                     "handle_asconf_ack: chunk too small = %xh\n",
1692                     ntohs(cp->ch.chunk_length));
1693                 return;
1694         }
1695         asoc = &stcb->asoc;
1696         serial_num = ntohl(cp->serial_number);
1697
1698         /*
1699          * NOTE: we may want to handle this differently- currently, we will
1700          * abort when we get an ack for the expected serial number + 1 (eg.
1701          * we didn't send it), process an ack normally if it is the expected
1702          * serial number, and re-send the previous ack for *ALL* other
1703          * serial numbers
1704          */
1705
1706         /*
1707          * if the serial number is the next expected, but I didn't send it,
1708          * abort the asoc, since someone probably just hijacked us...
1709          */
1710         if (serial_num == (asoc->asconf_seq_out + 1)) {
1711                 struct mbuf *op_err;
1712                 char msg[SCTP_DIAG_INFO_LEN];
1713
1714                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got unexpected next serial number! Aborting asoc!\n");
1715                 SCTP_SNPRINTF(msg, sizeof(msg), "Never sent serial number %8.8x", serial_num);
1716                 op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1717                 sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1718                 *abort_no_unlock = 1;
1719                 return;
1720         }
1721         if (serial_num != asoc->asconf_seq_out_acked + 1) {
1722                 /* got a duplicate/unexpected ASCONF-ACK */
1723                 SCTPDBG(SCTP_DEBUG_ASCONF1, "handle_asconf_ack: got duplicate/unexpected serial number = %xh (expected = %xh)\n",
1724                     serial_num, asoc->asconf_seq_out_acked + 1);
1725                 return;
1726         }
1727
1728         if (serial_num == asoc->asconf_seq_out - 1) {
1729                 /* stop our timer */
1730                 sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep, stcb, NULL,
1731                     SCTP_FROM_SCTP_ASCONF + SCTP_LOC_5);
1732         }
1733
1734         /* process the ASCONF-ACK contents */
1735         ack_length = ntohs(cp->ch.chunk_length) -
1736             sizeof(struct sctp_asconf_ack_chunk);
1737         offset += sizeof(struct sctp_asconf_ack_chunk);
1738         /* process through all parameters */
1739         while (ack_length >= sizeof(struct sctp_asconf_paramhdr)) {
1740                 unsigned int param_length, param_type;
1741
1742                 /* get pointer to next asconf parameter */
1743                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset,
1744                     sizeof(struct sctp_asconf_paramhdr), aparam_buf);
1745                 if (aph == NULL) {
1746                         /* can't get an asconf paramhdr */
1747                         sctp_asconf_ack_clear(stcb);
1748                         return;
1749                 }
1750                 param_type = ntohs(aph->ph.param_type);
1751                 param_length = ntohs(aph->ph.param_length);
1752                 if (param_length > ack_length) {
1753                         sctp_asconf_ack_clear(stcb);
1754                         return;
1755                 }
1756                 if (param_length < sizeof(struct sctp_paramhdr)) {
1757                         sctp_asconf_ack_clear(stcb);
1758                         return;
1759                 }
1760                 /* get the complete parameter... */
1761                 if (param_length > sizeof(aparam_buf)) {
1762                         SCTPDBG(SCTP_DEBUG_ASCONF1,
1763                             "param length (%u) larger than buffer size!\n", param_length);
1764                         sctp_asconf_ack_clear(stcb);
1765                         return;
1766                 }
1767                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(m, offset, param_length, aparam_buf);
1768                 if (aph == NULL) {
1769                         sctp_asconf_ack_clear(stcb);
1770                         return;
1771                 }
1772                 /* correlation_id is transparent to peer, no ntohl needed */
1773                 id = aph->correlation_id;
1774
1775                 switch (param_type) {
1776                 case SCTP_ERROR_CAUSE_IND:
1777                         last_error_id = id;
1778                         /* find the corresponding asconf param in our queue */
1779                         ap = sctp_asconf_find_param(stcb, id);
1780                         if (ap == NULL) {
1781                                 /* hmm... can't find this in our queue! */
1782                                 break;
1783                         }
1784                         /* process the parameter, failed flag */
1785                         sctp_asconf_process_param_ack(stcb, ap, 0);
1786                         /* process the error response */
1787                         sctp_asconf_process_error(stcb, aph);
1788                         break;
1789                 case SCTP_SUCCESS_REPORT:
1790                         /* find the corresponding asconf param in our queue */
1791                         ap = sctp_asconf_find_param(stcb, id);
1792                         if (ap == NULL) {
1793                                 /* hmm... can't find this in our queue! */
1794                                 break;
1795                         }
1796                         /* process the parameter, success flag */
1797                         sctp_asconf_process_param_ack(stcb, ap, 1);
1798                         break;
1799                 default:
1800                         break;
1801                 }               /* switch */
1802
1803                 /* update remaining ASCONF-ACK message length to process */
1804                 if (ack_length > SCTP_SIZE32(param_length)) {
1805                         ack_length -= SCTP_SIZE32(param_length);
1806                 } else {
1807                         break;
1808                 }
1809                 offset += SCTP_SIZE32(param_length);
1810         }                       /* while */
1811
1812         /*
1813          * if there are any "sent" params still on the queue, these are
1814          * implicitly "success", or "failed" (if we got an error back) ...
1815          * so process these appropriately
1816          *
1817          * we assume that the correlation_id's are monotonically increasing
1818          * beginning from 1 and that we don't have *that* many outstanding
1819          * at any given time
1820          */
1821         if (last_error_id == 0)
1822                 last_error_id--;        /* set to "max" value */
1823         TAILQ_FOREACH_SAFE(aa, &stcb->asoc.asconf_queue, next, aa_next) {
1824                 if (aa->sent == 1) {
1825                         /*
1826                          * implicitly successful or failed if correlation_id
1827                          * < last_error_id, then success else, failure
1828                          */
1829                         if (aa->ap.aph.correlation_id < last_error_id)
1830                                 sctp_asconf_process_param_ack(stcb, aa, 1);
1831                         else
1832                                 sctp_asconf_process_param_ack(stcb, aa, 0);
1833                 } else {
1834                         /*
1835                          * since we always process in order (FIFO queue) if
1836                          * we reach one that hasn't been sent, the rest
1837                          * should not have been sent either. so, we're
1838                          * done...
1839                          */
1840                         break;
1841                 }
1842         }
1843
1844         /* update the next sequence number to use */
1845         asoc->asconf_seq_out_acked++;
1846         /* remove the old ASCONF on our outbound queue */
1847         sctp_toss_old_asconf(stcb);
1848         if (!TAILQ_EMPTY(&stcb->asoc.asconf_queue)) {
1849 #ifdef SCTP_TIMER_BASED_ASCONF
1850                 /* we have more params, so restart our timer */
1851                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, stcb->sctp_ep,
1852                     stcb, net);
1853 #else
1854                 /* we have more params, so send out more */
1855                 sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
1856 #endif
1857         }
1858 }
1859
1860 #ifdef INET6
1861 static uint32_t
1862 sctp_is_scopeid_in_nets(struct sctp_tcb *stcb, struct sockaddr *sa)
1863 {
1864         struct sockaddr_in6 *sin6, *net6;
1865         struct sctp_nets *net;
1866
1867         if (sa->sa_family != AF_INET6) {
1868                 /* wrong family */
1869                 return (0);
1870         }
1871         sin6 = (struct sockaddr_in6 *)sa;
1872         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) == 0) {
1873                 /* not link local address */
1874                 return (0);
1875         }
1876         /* hunt through our destination nets list for this scope_id */
1877         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1878                 if (((struct sockaddr *)(&net->ro._l_addr))->sa_family !=
1879                     AF_INET6)
1880                         continue;
1881                 net6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1882                 if (IN6_IS_ADDR_LINKLOCAL(&net6->sin6_addr) == 0)
1883                         continue;
1884                 if (sctp_is_same_scope(sin6, net6)) {
1885                         /* found one */
1886                         return (1);
1887                 }
1888         }
1889         /* didn't find one */
1890         return (0);
1891 }
1892 #endif
1893
1894 /*
1895  * address management functions
1896  */
1897 static void
1898 sctp_addr_mgmt_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1899     struct sctp_ifa *ifa, uint16_t type, int addr_locked)
1900 {
1901         int status;
1902
1903         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0 ||
1904             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
1905                 /* subset bound, no ASCONF allowed case, so ignore */
1906                 return;
1907         }
1908         /*
1909          * note: we know this is not the subset bound, no ASCONF case eg.
1910          * this is boundall or subset bound w/ASCONF allowed
1911          */
1912
1913         /* first, make sure that the address is IPv4 or IPv6 and not jailed */
1914         switch (ifa->address.sa.sa_family) {
1915 #ifdef INET6
1916         case AF_INET6:
1917                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1918                     &ifa->address.sin6.sin6_addr) != 0) {
1919                         return;
1920                 }
1921                 break;
1922 #endif
1923 #ifdef INET
1924         case AF_INET:
1925                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1926                     &ifa->address.sin.sin_addr) != 0) {
1927                         return;
1928                 }
1929                 break;
1930 #endif
1931         default:
1932                 return;
1933         }
1934 #ifdef INET6
1935         /* make sure we're "allowed" to add this type of addr */
1936         if (ifa->address.sa.sa_family == AF_INET6) {
1937                 /* invalid if we're not a v6 endpoint */
1938                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)
1939                         return;
1940                 /* is the v6 addr really valid ? */
1941                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
1942                         return;
1943                 }
1944         }
1945 #endif
1946         /* put this address on the "pending/do not use yet" list */
1947         sctp_add_local_addr_restricted(stcb, ifa);
1948         /*
1949          * check address scope if address is out of scope, don't queue
1950          * anything... note: this would leave the address on both inp and
1951          * asoc lists
1952          */
1953         switch (ifa->address.sa.sa_family) {
1954 #ifdef INET6
1955         case AF_INET6:
1956                 {
1957                         struct sockaddr_in6 *sin6;
1958
1959                         sin6 = &ifa->address.sin6;
1960                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1961                                 /* we skip unspecifed addresses */
1962                                 return;
1963                         }
1964                         if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1965                                 if (stcb->asoc.scope.local_scope == 0) {
1966                                         return;
1967                                 }
1968                                 /* is it the right link local scope? */
1969                                 if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
1970                                         return;
1971                                 }
1972                         }
1973                         if (stcb->asoc.scope.site_scope == 0 &&
1974                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
1975                                 return;
1976                         }
1977                         break;
1978                 }
1979 #endif
1980 #ifdef INET
1981         case AF_INET:
1982                 {
1983                         struct sockaddr_in *sin;
1984
1985                         /* invalid if we are a v6 only endpoint */
1986                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1987                             SCTP_IPV6_V6ONLY(inp))
1988                                 return;
1989
1990                         sin = &ifa->address.sin;
1991                         if (sin->sin_addr.s_addr == 0) {
1992                                 /* we skip unspecifed addresses */
1993                                 return;
1994                         }
1995                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
1996                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
1997                                 return;
1998                         }
1999                         break;
2000                 }
2001 #endif
2002         default:
2003                 /* else, not AF_INET or AF_INET6, so skip */
2004                 return;
2005         }
2006
2007         /* queue an asconf for this address add/delete */
2008         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
2009                 /* does the peer do asconf? */
2010                 if (stcb->asoc.asconf_supported) {
2011                         /* queue an asconf for this addr */
2012                         status = sctp_asconf_queue_add(stcb, ifa, type);
2013
2014                         /*
2015                          * if queued ok, and in the open state, send out the
2016                          * ASCONF.  If in the non-open state, these will be
2017                          * sent when the state goes open.
2018                          */
2019                         if (status == 0 &&
2020                             ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
2021                             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED))) {
2022 #ifdef SCTP_TIMER_BASED_ASCONF
2023                                 sctp_timer_start(SCTP_TIMER_TYPE_ASCONF, inp,
2024                                     stcb, stcb->asoc.primary_destination);
2025 #else
2026                                 sctp_send_asconf(stcb, NULL, addr_locked);
2027 #endif
2028                         }
2029                 }
2030         }
2031 }
2032
2033
2034 int
2035 sctp_asconf_iterator_ep(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2036 {
2037         struct sctp_asconf_iterator *asc;
2038         struct sctp_ifa *ifa;
2039         struct sctp_laddr *l;
2040         int cnt_invalid = 0;
2041
2042         asc = (struct sctp_asconf_iterator *)ptr;
2043         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2044                 ifa = l->ifa;
2045                 switch (ifa->address.sa.sa_family) {
2046 #ifdef INET6
2047                 case AF_INET6:
2048                         /* invalid if we're not a v6 endpoint */
2049                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2050                                 cnt_invalid++;
2051                                 if (asc->cnt == cnt_invalid)
2052                                         return (1);
2053                         }
2054                         break;
2055 #endif
2056 #ifdef INET
2057                 case AF_INET:
2058                         {
2059                                 /* invalid if we are a v6 only endpoint */
2060                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2061                                     SCTP_IPV6_V6ONLY(inp)) {
2062                                         cnt_invalid++;
2063                                         if (asc->cnt == cnt_invalid)
2064                                                 return (1);
2065                                 }
2066                                 break;
2067                         }
2068 #endif
2069                 default:
2070                         /* invalid address family */
2071                         cnt_invalid++;
2072                         if (asc->cnt == cnt_invalid)
2073                                 return (1);
2074                 }
2075         }
2076         return (0);
2077 }
2078
2079 static int
2080 sctp_asconf_iterator_ep_end(struct sctp_inpcb *inp, void *ptr, uint32_t val SCTP_UNUSED)
2081 {
2082         struct sctp_ifa *ifa;
2083         struct sctp_asconf_iterator *asc;
2084         struct sctp_laddr *laddr, *nladdr, *l;
2085
2086         /* Only for specific case not bound all */
2087         asc = (struct sctp_asconf_iterator *)ptr;
2088         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2089                 ifa = l->ifa;
2090                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2091                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
2092                             sctp_nxt_addr) {
2093                                 if (laddr->ifa == ifa) {
2094                                         laddr->action = 0;
2095                                         break;
2096                                 }
2097
2098                         }
2099                 } else if (l->action == SCTP_DEL_IP_ADDRESS) {
2100                         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
2101                                 /* remove only after all guys are done */
2102                                 if (laddr->ifa == ifa) {
2103                                         sctp_del_local_addr_ep(inp, ifa);
2104                                 }
2105                         }
2106                 }
2107         }
2108         return (0);
2109 }
2110
2111 void
2112 sctp_asconf_iterator_stcb(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2113     void *ptr, uint32_t val SCTP_UNUSED)
2114 {
2115         struct sctp_asconf_iterator *asc;
2116         struct sctp_ifa *ifa;
2117         struct sctp_laddr *l;
2118         int cnt_invalid = 0;
2119         int type, status;
2120         int num_queued = 0;
2121
2122         asc = (struct sctp_asconf_iterator *)ptr;
2123         LIST_FOREACH(l, &asc->list_of_work, sctp_nxt_addr) {
2124                 ifa = l->ifa;
2125                 type = l->action;
2126
2127                 /* address's vrf_id must be the vrf_id of the assoc */
2128                 if (ifa->vrf_id != stcb->asoc.vrf_id) {
2129                         continue;
2130                 }
2131
2132                 /* Same checks again for assoc */
2133                 switch (ifa->address.sa.sa_family) {
2134 #ifdef INET6
2135                 case AF_INET6:
2136                         {
2137                                 /* invalid if we're not a v6 endpoint */
2138                                 struct sockaddr_in6 *sin6;
2139
2140                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
2141                                         cnt_invalid++;
2142                                         if (asc->cnt == cnt_invalid)
2143                                                 return;
2144                                         else
2145                                                 continue;
2146                                 }
2147                                 sin6 = &ifa->address.sin6;
2148                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2149                                         /* we skip unspecifed addresses */
2150                                         continue;
2151                                 }
2152                                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
2153                                     &sin6->sin6_addr) != 0) {
2154                                         continue;
2155                                 }
2156                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2157                                         if (stcb->asoc.scope.local_scope == 0) {
2158                                                 continue;
2159                                         }
2160                                         /* is it the right link local scope? */
2161                                         if (sctp_is_scopeid_in_nets(stcb, &ifa->address.sa) == 0) {
2162                                                 continue;
2163                                         }
2164                                 }
2165                                 break;
2166                         }
2167 #endif
2168 #ifdef INET
2169                 case AF_INET:
2170                         {
2171                                 /* invalid if we are a v6 only endpoint */
2172                                 struct sockaddr_in *sin;
2173
2174                                 /* invalid if we are a v6 only endpoint */
2175                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2176                                     SCTP_IPV6_V6ONLY(inp))
2177                                         continue;
2178
2179                                 sin = &ifa->address.sin;
2180                                 if (sin->sin_addr.s_addr == 0) {
2181                                         /* we skip unspecifed addresses */
2182                                         continue;
2183                                 }
2184                                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
2185                                     &sin->sin_addr) != 0) {
2186                                         continue;
2187                                 }
2188                                 if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2189                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2190                                         continue;
2191                                 }
2192                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2193                                     SCTP_IPV6_V6ONLY(inp)) {
2194                                         cnt_invalid++;
2195                                         if (asc->cnt == cnt_invalid)
2196                                                 return;
2197                                         else
2198                                                 continue;
2199                                 }
2200                                 break;
2201                         }
2202 #endif
2203                 default:
2204                         /* invalid address family */
2205                         cnt_invalid++;
2206                         if (asc->cnt == cnt_invalid)
2207                                 return;
2208                         else
2209                                 continue;
2210                         break;
2211                 }
2212
2213                 if (type == SCTP_ADD_IP_ADDRESS) {
2214                         /* prevent this address from being used as a source */
2215                         sctp_add_local_addr_restricted(stcb, ifa);
2216                 } else if (type == SCTP_DEL_IP_ADDRESS) {
2217                         struct sctp_nets *net;
2218
2219                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2220                                 sctp_rtentry_t *rt;
2221
2222                                 /* delete this address if cached */
2223                                 if (net->ro._s_addr == ifa) {
2224                                         sctp_free_ifa(net->ro._s_addr);
2225                                         net->ro._s_addr = NULL;
2226                                         net->src_addr_selected = 0;
2227                                         rt = net->ro.ro_rt;
2228                                         if (rt) {
2229                                                 RTFREE(rt);
2230                                                 net->ro.ro_rt = NULL;
2231                                         }
2232                                         /*
2233                                          * Now we deleted our src address,
2234                                          * should we not also now reset the
2235                                          * cwnd/rto to start as if its a new
2236                                          * address?
2237                                          */
2238                                         stcb->asoc.cc_functions.sctp_set_initial_cc_param(stcb, net);
2239                                         net->RTO = 0;
2240
2241                                 }
2242                         }
2243                 } else if (type == SCTP_SET_PRIM_ADDR) {
2244                         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2245                                 /* must validate the ifa is in the ep */
2246                                 if (sctp_is_addr_in_ep(stcb->sctp_ep, ifa) == 0) {
2247                                         continue;
2248                                 }
2249                         } else {
2250                                 /* Need to check scopes for this guy */
2251                                 if (sctp_is_address_in_scope(ifa, &stcb->asoc.scope, 0) == 0) {
2252                                         continue;
2253                                 }
2254                         }
2255                 }
2256                 /* queue an asconf for this address add/delete */
2257                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF) &&
2258                     stcb->asoc.asconf_supported == 1) {
2259                         /* queue an asconf for this addr */
2260                         status = sctp_asconf_queue_add(stcb, ifa, type);
2261                         /*
2262                          * if queued ok, and in the open state, update the
2263                          * count of queued params.  If in the non-open
2264                          * state, these get sent when the assoc goes open.
2265                          */
2266                         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
2267                             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2268                                 if (status >= 0) {
2269                                         num_queued++;
2270                                 }
2271                         }
2272                 }
2273         }
2274         /*
2275          * If we have queued params in the open state, send out an ASCONF.
2276          */
2277         if (num_queued > 0) {
2278                 sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2279         }
2280 }
2281
2282 void
2283 sctp_asconf_iterator_end(void *ptr, uint32_t val SCTP_UNUSED)
2284 {
2285         struct sctp_asconf_iterator *asc;
2286         struct sctp_ifa *ifa;
2287         struct sctp_laddr *l, *nl;
2288
2289         asc = (struct sctp_asconf_iterator *)ptr;
2290         LIST_FOREACH_SAFE(l, &asc->list_of_work, sctp_nxt_addr, nl) {
2291                 ifa = l->ifa;
2292                 if (l->action == SCTP_ADD_IP_ADDRESS) {
2293                         /* Clear the defer use flag */
2294                         ifa->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
2295                 }
2296                 sctp_free_ifa(ifa);
2297                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), l);
2298                 SCTP_DECR_LADDR_COUNT();
2299         }
2300         SCTP_FREE(asc, SCTP_M_ASC_IT);
2301 }
2302
2303 /*
2304  * sa is the sockaddr to ask the peer to set primary to.
2305  * returns: 0 = completed, -1 = error
2306  */
2307 int32_t
2308 sctp_set_primary_ip_address_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
2309 {
2310         uint32_t vrf_id;
2311         struct sctp_ifa *ifa;
2312
2313         /* find the ifa for the desired set primary */
2314         vrf_id = stcb->asoc.vrf_id;
2315         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
2316         if (ifa == NULL) {
2317                 /* Invalid address */
2318                 return (-1);
2319         }
2320
2321         /* queue an ASCONF:SET_PRIM_ADDR to be sent */
2322         if (!sctp_asconf_queue_add(stcb, ifa, SCTP_SET_PRIM_ADDR)) {
2323                 /* set primary queuing succeeded */
2324                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2325                     "set_primary_ip_address_sa: queued on tcb=%p, ",
2326                     (void *)stcb);
2327                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2328                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
2329                     (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2330 #ifdef SCTP_TIMER_BASED_ASCONF
2331                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2332                             stcb->sctp_ep, stcb,
2333                             stcb->asoc.primary_destination);
2334 #else
2335                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2336 #endif
2337                 }
2338         } else {
2339                 SCTPDBG(SCTP_DEBUG_ASCONF1, "set_primary_ip_address_sa: failed to add to queue on tcb=%p, ",
2340                     (void *)stcb);
2341                 SCTPDBG_ADDR(SCTP_DEBUG_ASCONF1, sa);
2342                 return (-1);
2343         }
2344         return (0);
2345 }
2346
2347 int
2348 sctp_is_addr_pending(struct sctp_tcb *stcb, struct sctp_ifa *sctp_ifa)
2349 {
2350         struct sctp_tmit_chunk *chk, *nchk;
2351         unsigned int offset, asconf_limit;
2352         struct sctp_asconf_chunk *acp;
2353         struct sctp_asconf_paramhdr *aph;
2354         uint8_t aparam_buf[SCTP_PARAM_BUFFER_SIZE];
2355         struct sctp_paramhdr *ph;
2356         int add_cnt, del_cnt;
2357         uint16_t last_param_type;
2358
2359         add_cnt = del_cnt = 0;
2360         last_param_type = 0;
2361         TAILQ_FOREACH_SAFE(chk, &stcb->asoc.asconf_send_queue, sctp_next, nchk) {
2362                 if (chk->data == NULL) {
2363                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: No mbuf data?\n");
2364                         continue;
2365                 }
2366                 offset = 0;
2367                 acp = mtod(chk->data, struct sctp_asconf_chunk *);
2368                 offset += sizeof(struct sctp_asconf_chunk);
2369                 asconf_limit = ntohs(acp->ch.chunk_length);
2370                 ph = (struct sctp_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_paramhdr), aparam_buf);
2371                 if (ph == NULL) {
2372                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get lookup addr!\n");
2373                         continue;
2374                 }
2375                 offset += ntohs(ph->param_length);
2376
2377                 aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2378                 if (aph == NULL) {
2379                         SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: Empty ASCONF will be sent?\n");
2380                         continue;
2381                 }
2382                 while (aph != NULL) {
2383                         unsigned int param_length, param_type;
2384
2385                         param_type = ntohs(aph->ph.param_type);
2386                         param_length = ntohs(aph->ph.param_length);
2387                         if (offset + param_length > asconf_limit) {
2388                                 /* parameter goes beyond end of chunk! */
2389                                 break;
2390                         }
2391                         if (param_length > sizeof(aparam_buf)) {
2392                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length (%u) larger than buffer size!\n", param_length);
2393                                 break;
2394                         }
2395                         if (param_length <= sizeof(struct sctp_paramhdr)) {
2396                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: param length(%u) too short\n", param_length);
2397                                 break;
2398                         }
2399
2400                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, param_length, aparam_buf);
2401                         if (aph == NULL) {
2402                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "is_addr_pending: couldn't get entire param\n");
2403                                 break;
2404                         }
2405
2406                         ph = (struct sctp_paramhdr *)(aph + 1);
2407                         if (sctp_addr_match(ph, &sctp_ifa->address.sa) != 0) {
2408                                 switch (param_type) {
2409                                 case SCTP_ADD_IP_ADDRESS:
2410                                         add_cnt++;
2411                                         break;
2412                                 case SCTP_DEL_IP_ADDRESS:
2413                                         del_cnt++;
2414                                         break;
2415                                 default:
2416                                         break;
2417                                 }
2418                                 last_param_type = param_type;
2419                         }
2420
2421                         offset += SCTP_SIZE32(param_length);
2422                         if (offset >= asconf_limit) {
2423                                 /* no more data in the mbuf chain */
2424                                 break;
2425                         }
2426                         /* get pointer to next asconf param */
2427                         aph = (struct sctp_asconf_paramhdr *)sctp_m_getptr(chk->data, offset, sizeof(struct sctp_asconf_paramhdr), aparam_buf);
2428                 }
2429         }
2430
2431         /*
2432          * we want to find the sequences which consist of ADD -> DEL -> ADD
2433          * or DEL -> ADD
2434          */
2435         if (add_cnt > del_cnt ||
2436             (add_cnt == del_cnt && last_param_type == SCTP_ADD_IP_ADDRESS)) {
2437                 return (1);
2438         }
2439         return (0);
2440 }
2441
2442 static struct sockaddr *
2443 sctp_find_valid_localaddr(struct sctp_tcb *stcb, int addr_locked)
2444 {
2445         struct sctp_vrf *vrf = NULL;
2446         struct sctp_ifn *sctp_ifn;
2447         struct sctp_ifa *sctp_ifa;
2448
2449         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2450                 SCTP_IPI_ADDR_RLOCK();
2451         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
2452         if (vrf == NULL) {
2453                 if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2454                         SCTP_IPI_ADDR_RUNLOCK();
2455                 return (NULL);
2456         }
2457         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
2458                 if (stcb->asoc.scope.loopback_scope == 0 &&
2459                     SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
2460                         /* Skip if loopback_scope not set */
2461                         continue;
2462                 }
2463                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
2464                         switch (sctp_ifa->address.sa.sa_family) {
2465 #ifdef INET
2466                         case AF_INET:
2467                                 if (stcb->asoc.scope.ipv4_addr_legal) {
2468                                         struct sockaddr_in *sin;
2469
2470                                         sin = &sctp_ifa->address.sin;
2471                                         if (sin->sin_addr.s_addr == 0) {
2472                                                 /* skip unspecifed addresses */
2473                                                 continue;
2474                                         }
2475                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
2476                                             &sin->sin_addr) != 0) {
2477                                                 continue;
2478                                         }
2479                                         if (stcb->asoc.scope.ipv4_local_scope == 0 &&
2480                                             IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))
2481                                                 continue;
2482
2483                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2484                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2485                                                 continue;
2486                                         /*
2487                                          * found a valid local v4 address to
2488                                          * use
2489                                          */
2490                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2491                                                 SCTP_IPI_ADDR_RUNLOCK();
2492                                         return (&sctp_ifa->address.sa);
2493                                 }
2494                                 break;
2495 #endif
2496 #ifdef INET6
2497                         case AF_INET6:
2498                                 if (stcb->asoc.scope.ipv6_addr_legal) {
2499                                         struct sockaddr_in6 *sin6;
2500
2501                                         if (sctp_ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2502                                                 continue;
2503                                         }
2504
2505                                         sin6 = &sctp_ifa->address.sin6;
2506                                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2507                                                 /*
2508                                                  * we skip unspecifed
2509                                                  * addresses
2510                                                  */
2511                                                 continue;
2512                                         }
2513                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
2514                                             &sin6->sin6_addr) != 0) {
2515                                                 continue;
2516                                         }
2517                                         if (stcb->asoc.scope.local_scope == 0 &&
2518                                             IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
2519                                                 continue;
2520                                         if (stcb->asoc.scope.site_scope == 0 &&
2521                                             IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))
2522                                                 continue;
2523
2524                                         if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
2525                                             (!sctp_is_addr_pending(stcb, sctp_ifa)))
2526                                                 continue;
2527                                         /*
2528                                          * found a valid local v6 address to
2529                                          * use
2530                                          */
2531                                         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2532                                                 SCTP_IPI_ADDR_RUNLOCK();
2533                                         return (&sctp_ifa->address.sa);
2534                                 }
2535                                 break;
2536 #endif
2537                         default:
2538                                 break;
2539                         }
2540                 }
2541         }
2542         /* no valid addresses found */
2543         if (addr_locked == SCTP_ADDR_NOT_LOCKED)
2544                 SCTP_IPI_ADDR_RUNLOCK();
2545         return (NULL);
2546 }
2547
2548 static struct sockaddr *
2549 sctp_find_valid_localaddr_ep(struct sctp_tcb *stcb)
2550 {
2551         struct sctp_laddr *laddr;
2552
2553         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
2554                 if (laddr->ifa == NULL) {
2555                         continue;
2556                 }
2557                 /* is the address restricted ? */
2558                 if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
2559                     (!sctp_is_addr_pending(stcb, laddr->ifa)))
2560                         continue;
2561
2562                 /* found a valid local address to use */
2563                 return (&laddr->ifa->address.sa);
2564         }
2565         /* no valid addresses found */
2566         return (NULL);
2567 }
2568
2569 /*
2570  * builds an ASCONF chunk from queued ASCONF params.
2571  * returns NULL on error (no mbuf, no ASCONF params queued, etc).
2572  */
2573 struct mbuf *
2574 sctp_compose_asconf(struct sctp_tcb *stcb, int *retlen, int addr_locked)
2575 {
2576         struct mbuf *m_asconf, *m_asconf_chk;
2577         struct sctp_asconf_addr *aa;
2578         struct sctp_asconf_chunk *acp;
2579         struct sctp_asconf_paramhdr *aph;
2580         struct sctp_asconf_addr_param *aap;
2581         uint32_t p_length;
2582         uint32_t correlation_id = 1;    /* 0 is reserved... */
2583         caddr_t ptr, lookup_ptr;
2584         uint8_t lookup_used = 0;
2585
2586         /* are there any asconf params to send? */
2587         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2588                 if (aa->sent == 0)
2589                         break;
2590         }
2591         if (aa == NULL)
2592                 return (NULL);
2593
2594         /*
2595          * get a chunk header mbuf and a cluster for the asconf params since
2596          * it's simpler to fill in the asconf chunk header lookup address on
2597          * the fly
2598          */
2599         m_asconf_chk = sctp_get_mbuf_for_msg(sizeof(struct sctp_asconf_chunk), 0, M_NOWAIT, 1, MT_DATA);
2600         if (m_asconf_chk == NULL) {
2601                 /* no mbuf's */
2602                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2603                     "sctp_compose_asconf: couldn't get chunk mbuf!\n");
2604                 return (NULL);
2605         }
2606         m_asconf = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
2607         if (m_asconf == NULL) {
2608                 /* no mbuf's */
2609                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2610                     "sctp_compose_asconf: couldn't get mbuf!\n");
2611                 sctp_m_freem(m_asconf_chk);
2612                 return (NULL);
2613         }
2614         SCTP_BUF_LEN(m_asconf_chk) = sizeof(struct sctp_asconf_chunk);
2615         SCTP_BUF_LEN(m_asconf) = 0;
2616         acp = mtod(m_asconf_chk, struct sctp_asconf_chunk *);
2617         memset(acp, 0, sizeof(struct sctp_asconf_chunk));
2618         /* save pointers to lookup address and asconf params */
2619         lookup_ptr = (caddr_t)(acp + 1);        /* after the header */
2620         ptr = mtod(m_asconf, caddr_t);  /* beginning of cluster */
2621
2622         /* fill in chunk header info */
2623         acp->ch.chunk_type = SCTP_ASCONF;
2624         acp->ch.chunk_flags = 0;
2625         acp->serial_number = htonl(stcb->asoc.asconf_seq_out);
2626         stcb->asoc.asconf_seq_out++;
2627
2628         /* add parameters... up to smallest MTU allowed */
2629         TAILQ_FOREACH(aa, &stcb->asoc.asconf_queue, next) {
2630                 if (aa->sent)
2631                         continue;
2632                 /* get the parameter length */
2633                 p_length = SCTP_SIZE32(aa->ap.aph.ph.param_length);
2634                 /* will it fit in current chunk? */
2635                 if ((SCTP_BUF_LEN(m_asconf) + p_length > stcb->asoc.smallest_mtu) ||
2636                     (SCTP_BUF_LEN(m_asconf) + p_length > MCLBYTES)) {
2637                         /* won't fit, so we're done with this chunk */
2638                         break;
2639                 }
2640                 /* assign (and store) a correlation id */
2641                 aa->ap.aph.correlation_id = correlation_id++;
2642
2643                 /*
2644                  * fill in address if we're doing a delete this is a simple
2645                  * way for us to fill in the correlation address, which
2646                  * should only be used by the peer if we're deleting our
2647                  * source address and adding a new address (e.g. renumbering
2648                  * case)
2649                  */
2650                 if (lookup_used == 0 &&
2651                     (aa->special_del == 0) &&
2652                     aa->ap.aph.ph.param_type == SCTP_DEL_IP_ADDRESS) {
2653                         struct sctp_ipv6addr_param *lookup;
2654                         uint16_t p_size, addr_size;
2655
2656                         lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2657                         lookup->ph.param_type =
2658                             htons(aa->ap.addrp.ph.param_type);
2659                         if (aa->ap.addrp.ph.param_type == SCTP_IPV6_ADDRESS) {
2660                                 /* copy IPv6 address */
2661                                 p_size = sizeof(struct sctp_ipv6addr_param);
2662                                 addr_size = sizeof(struct in6_addr);
2663                         } else {
2664                                 /* copy IPv4 address */
2665                                 p_size = sizeof(struct sctp_ipv4addr_param);
2666                                 addr_size = sizeof(struct in_addr);
2667                         }
2668                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2669                         memcpy(lookup->addr, &aa->ap.addrp.addr, addr_size);
2670                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2671                         lookup_used = 1;
2672                 }
2673                 /* copy into current space */
2674                 memcpy(ptr, &aa->ap, p_length);
2675
2676                 /* network elements and update lengths */
2677                 aph = (struct sctp_asconf_paramhdr *)ptr;
2678                 aap = (struct sctp_asconf_addr_param *)ptr;
2679                 /* correlation_id is transparent to peer, no htonl needed */
2680                 aph->ph.param_type = htons(aph->ph.param_type);
2681                 aph->ph.param_length = htons(aph->ph.param_length);
2682                 aap->addrp.ph.param_type = htons(aap->addrp.ph.param_type);
2683                 aap->addrp.ph.param_length = htons(aap->addrp.ph.param_length);
2684
2685                 SCTP_BUF_LEN(m_asconf) += SCTP_SIZE32(p_length);
2686                 ptr += SCTP_SIZE32(p_length);
2687
2688                 /*
2689                  * these params are removed off the pending list upon
2690                  * getting an ASCONF-ACK back from the peer, just set flag
2691                  */
2692                 aa->sent = 1;
2693         }
2694         /* check to see if the lookup addr has been populated yet */
2695         if (lookup_used == 0) {
2696                 /* NOTE: if the address param is optional, can skip this... */
2697                 /* add any valid (existing) address... */
2698                 struct sctp_ipv6addr_param *lookup;
2699                 uint16_t p_size, addr_size;
2700                 struct sockaddr *found_addr;
2701                 caddr_t addr_ptr;
2702
2703                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)
2704                         found_addr = sctp_find_valid_localaddr(stcb,
2705                             addr_locked);
2706                 else
2707                         found_addr = sctp_find_valid_localaddr_ep(stcb);
2708
2709                 lookup = (struct sctp_ipv6addr_param *)lookup_ptr;
2710                 if (found_addr != NULL) {
2711                         switch (found_addr->sa_family) {
2712 #ifdef INET6
2713                         case AF_INET6:
2714                                 /* copy IPv6 address */
2715                                 lookup->ph.param_type =
2716                                     htons(SCTP_IPV6_ADDRESS);
2717                                 p_size = sizeof(struct sctp_ipv6addr_param);
2718                                 addr_size = sizeof(struct in6_addr);
2719                                 addr_ptr = (caddr_t)&((struct sockaddr_in6 *)
2720                                     found_addr)->sin6_addr;
2721                                 break;
2722 #endif
2723 #ifdef INET
2724                         case AF_INET:
2725                                 /* copy IPv4 address */
2726                                 lookup->ph.param_type =
2727                                     htons(SCTP_IPV4_ADDRESS);
2728                                 p_size = sizeof(struct sctp_ipv4addr_param);
2729                                 addr_size = sizeof(struct in_addr);
2730                                 addr_ptr = (caddr_t)&((struct sockaddr_in *)
2731                                     found_addr)->sin_addr;
2732                                 break;
2733 #endif
2734                         default:
2735                                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2736                                     "sctp_compose_asconf: no usable lookup addr (family = %d)!\n",
2737                                     found_addr->sa_family);
2738                                 sctp_m_freem(m_asconf_chk);
2739                                 sctp_m_freem(m_asconf);
2740                                 return (NULL);
2741                         }
2742                         lookup->ph.param_length = htons(SCTP_SIZE32(p_size));
2743                         memcpy(lookup->addr, addr_ptr, addr_size);
2744                         SCTP_BUF_LEN(m_asconf_chk) += SCTP_SIZE32(p_size);
2745                 } else {
2746                         /* uh oh... don't have any address?? */
2747                         SCTPDBG(SCTP_DEBUG_ASCONF1,
2748                             "sctp_compose_asconf: no lookup addr!\n");
2749                         sctp_m_freem(m_asconf_chk);
2750                         sctp_m_freem(m_asconf);
2751                         return (NULL);
2752                 }
2753         }
2754         /* chain it all together */
2755         SCTP_BUF_NEXT(m_asconf_chk) = m_asconf;
2756         *retlen = SCTP_BUF_LEN(m_asconf_chk) + SCTP_BUF_LEN(m_asconf);
2757         acp->ch.chunk_length = htons(*retlen);
2758
2759         return (m_asconf_chk);
2760 }
2761
2762 /*
2763  * section to handle address changes before an association is up eg. changes
2764  * during INIT/INIT-ACK/COOKIE-ECHO handshake
2765  */
2766
2767 /*
2768  * processes the (local) addresses in the INIT-ACK chunk
2769  */
2770 static void
2771 sctp_process_initack_addresses(struct sctp_tcb *stcb, struct mbuf *m,
2772     unsigned int offset, unsigned int length)
2773 {
2774         struct sctp_paramhdr tmp_param, *ph;
2775         uint16_t plen, ptype;
2776         struct sctp_ifa *sctp_ifa;
2777         union sctp_sockstore store;
2778 #ifdef INET6
2779         struct sctp_ipv6addr_param addr6_store;
2780 #endif
2781 #ifdef INET
2782         struct sctp_ipv4addr_param addr4_store;
2783 #endif
2784
2785         SCTPDBG(SCTP_DEBUG_ASCONF2, "processing init-ack addresses\n");
2786         if (stcb == NULL)       /* Un-needed check for SA */
2787                 return;
2788
2789         /* convert to upper bound */
2790         length += offset;
2791
2792         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2793                 return;
2794         }
2795         /* go through the addresses in the init-ack */
2796         ph = (struct sctp_paramhdr *)
2797             sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
2798             (uint8_t *)&tmp_param);
2799         while (ph != NULL) {
2800                 ptype = ntohs(ph->param_type);
2801                 plen = ntohs(ph->param_length);
2802                 switch (ptype) {
2803 #ifdef INET6
2804                 case SCTP_IPV6_ADDRESS:
2805                         {
2806                                 struct sctp_ipv6addr_param *a6p;
2807
2808                                 /* get the entire IPv6 address param */
2809                                 a6p = (struct sctp_ipv6addr_param *)
2810                                     sctp_m_getptr(m, offset,
2811                                     sizeof(struct sctp_ipv6addr_param),
2812                                     (uint8_t *)&addr6_store);
2813                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
2814                                     a6p == NULL) {
2815                                         return;
2816                                 }
2817                                 memset(&store, 0, sizeof(union sctp_sockstore));
2818                                 store.sin6.sin6_family = AF_INET6;
2819                                 store.sin6.sin6_len = sizeof(struct sockaddr_in6);
2820                                 store.sin6.sin6_port = stcb->rport;
2821                                 memcpy(&store.sin6.sin6_addr, a6p->addr, sizeof(struct in6_addr));
2822                                 break;
2823                         }
2824 #endif
2825 #ifdef INET
2826                 case SCTP_IPV4_ADDRESS:
2827                         {
2828                                 struct sctp_ipv4addr_param *a4p;
2829
2830                                 /* get the entire IPv4 address param */
2831                                 a4p = (struct sctp_ipv4addr_param *)sctp_m_getptr(m, offset,
2832                                     sizeof(struct sctp_ipv4addr_param),
2833                                     (uint8_t *)&addr4_store);
2834                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
2835                                     a4p == NULL) {
2836                                         return;
2837                                 }
2838                                 memset(&store, 0, sizeof(union sctp_sockstore));
2839                                 store.sin.sin_family = AF_INET;
2840                                 store.sin.sin_len = sizeof(struct sockaddr_in);
2841                                 store.sin.sin_port = stcb->rport;
2842                                 store.sin.sin_addr.s_addr = a4p->addr;
2843                                 break;
2844                         }
2845 #endif
2846                 default:
2847                         goto next_addr;
2848                 }
2849
2850                 /* see if this address really (still) exists */
2851                 sctp_ifa = sctp_find_ifa_by_addr(&store.sa, stcb->asoc.vrf_id,
2852                     SCTP_ADDR_NOT_LOCKED);
2853                 if (sctp_ifa == NULL) {
2854                         /* address doesn't exist anymore */
2855                         int status;
2856
2857                         /* are ASCONFs allowed ? */
2858                         if ((sctp_is_feature_on(stcb->sctp_ep,
2859                             SCTP_PCB_FLAGS_DO_ASCONF)) &&
2860                             stcb->asoc.asconf_supported) {
2861                                 /* queue an ASCONF DEL_IP_ADDRESS */
2862                                 status = sctp_asconf_queue_sa_delete(stcb, &store.sa);
2863                                 /*
2864                                  * if queued ok, and in correct state, send
2865                                  * out the ASCONF.
2866                                  */
2867                                 if (status == 0 &&
2868                                     SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) {
2869 #ifdef SCTP_TIMER_BASED_ASCONF
2870                                         sctp_timer_start(SCTP_TIMER_TYPE_ASCONF,
2871                                             stcb->sctp_ep, stcb,
2872                                             stcb->asoc.primary_destination);
2873 #else
2874                                         sctp_send_asconf(stcb, NULL, SCTP_ADDR_NOT_LOCKED);
2875 #endif
2876                                 }
2877                         }
2878                 }
2879
2880 next_addr:
2881                 /*
2882                  * Sanity check:  Make sure the length isn't 0, otherwise
2883                  * we'll be stuck in this loop for a long time...
2884                  */
2885                 if (SCTP_SIZE32(plen) == 0) {
2886                         SCTP_PRINTF("process_initack_addrs: bad len (%d) type=%xh\n",
2887                             plen, ptype);
2888                         return;
2889                 }
2890                 /* get next parameter */
2891                 offset += SCTP_SIZE32(plen);
2892                 if ((offset + sizeof(struct sctp_paramhdr)) > length)
2893                         return;
2894                 ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2895                     sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2896         }                       /* while */
2897 }
2898
2899 /* FIX ME: need to verify return result for v6 address type if v6 disabled */
2900 /*
2901  * checks to see if a specific address is in the initack address list returns
2902  * 1 if found, 0 if not
2903  */
2904 static uint32_t
2905 sctp_addr_in_initack(struct mbuf *m, uint32_t offset, uint32_t length, struct sockaddr *sa)
2906 {
2907         struct sctp_paramhdr tmp_param, *ph;
2908         uint16_t plen, ptype;
2909 #ifdef INET
2910         struct sockaddr_in *sin;
2911         struct sctp_ipv4addr_param *a4p;
2912         struct sctp_ipv6addr_param addr4_store;
2913 #endif
2914 #ifdef INET6
2915         struct sockaddr_in6 *sin6;
2916         struct sctp_ipv6addr_param *a6p;
2917         struct sctp_ipv6addr_param addr6_store;
2918         struct sockaddr_in6 sin6_tmp;
2919 #endif
2920
2921         switch (sa->sa_family) {
2922 #ifdef INET
2923         case AF_INET:
2924                 break;
2925 #endif
2926 #ifdef INET6
2927         case AF_INET6:
2928                 break;
2929 #endif
2930         default:
2931                 return (0);
2932         }
2933
2934         SCTPDBG(SCTP_DEBUG_ASCONF2, "find_initack_addr: starting search for ");
2935         SCTPDBG_ADDR(SCTP_DEBUG_ASCONF2, sa);
2936         /* convert to upper bound */
2937         length += offset;
2938
2939         if ((offset + sizeof(struct sctp_paramhdr)) > length) {
2940                 SCTPDBG(SCTP_DEBUG_ASCONF1,
2941                     "find_initack_addr: invalid offset?\n");
2942                 return (0);
2943         }
2944         /* go through the addresses in the init-ack */
2945         ph = (struct sctp_paramhdr *)sctp_m_getptr(m, offset,
2946             sizeof(struct sctp_paramhdr), (uint8_t *)&tmp_param);
2947         while (ph != NULL) {
2948                 ptype = ntohs(ph->param_type);
2949                 plen = ntohs(ph->param_length);
2950                 switch (ptype) {
2951 #ifdef INET6
2952                 case SCTP_IPV6_ADDRESS:
2953                         if (sa->sa_family == AF_INET6) {
2954                                 /* get the entire IPv6 address param */
2955                                 if (plen != sizeof(struct sctp_ipv6addr_param)) {
2956                                         break;
2957                                 }
2958                                 /* get the entire IPv6 address param */
2959                                 a6p = (struct sctp_ipv6addr_param *)
2960                                     sctp_m_getptr(m, offset,
2961                                     sizeof(struct sctp_ipv6addr_param),
2962                                     (uint8_t *)&addr6_store);
2963                                 if (a6p == NULL) {
2964                                         return (0);
2965                                 }
2966                                 sin6 = (struct sockaddr_in6 *)sa;
2967                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2968                                         /* create a copy and clear scope */
2969                                         memcpy(&sin6_tmp, sin6,
2970                                             sizeof(struct sockaddr_in6));
2971                                         sin6 = &sin6_tmp;
2972                                         in6_clearscope(&sin6->sin6_addr);
2973                                 }
2974                                 if (memcmp(&sin6->sin6_addr, a6p->addr,
2975                                     sizeof(struct in6_addr)) == 0) {
2976                                         /* found it */
2977                                         return (1);
2978                                 }
2979                         }
2980                         break;
2981 #endif                          /* INET6 */
2982 #ifdef INET
2983                 case SCTP_IPV4_ADDRESS:
2984                         if (sa->sa_family == AF_INET) {
2985                                 if (plen != sizeof(struct sctp_ipv4addr_param)) {
2986                                         break;
2987                                 }
2988                                 /* get the entire IPv4 address param */
2989                                 a4p = (struct sctp_ipv4addr_param *)
2990                                     sctp_m_getptr(m, offset,
2991                                     sizeof(struct sctp_ipv4addr_param),
2992                                     (uint8_t *)&addr4_store);
2993                                 if (a4p == NULL) {
2994                                         return (0);
2995                                 }
2996                                 sin = (struct sockaddr_in *)sa;
2997                                 if (sin->sin_addr.s_addr == a4p->addr) {
2998                                         /* found it */
2999                                         return (1);
3000                                 }
3001                         }
3002                         break;
3003 #endif
3004                 default:
3005                         break;
3006                 }
3007                 /* get next parameter */
3008                 offset += SCTP_SIZE32(plen);
3009                 if (offset + sizeof(struct sctp_paramhdr) > length) {
3010                         return (0);
3011                 }
3012                 ph = (struct sctp_paramhdr *)
3013                     sctp_m_getptr(m, offset, sizeof(struct sctp_paramhdr),
3014                     (uint8_t *)&tmp_param);
3015         }                       /* while */
3016         /* not found! */
3017         return (0);
3018 }
3019
3020 /*
3021  * makes sure that the current endpoint local addr list is consistent with
3022  * the new association (eg. subset bound, asconf allowed) adds addresses as
3023  * necessary
3024  */
3025 static void
3026 sctp_check_address_list_ep(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3027     int length, struct sockaddr *init_addr)
3028 {
3029         struct sctp_laddr *laddr;
3030
3031         /* go through the endpoint list */
3032         LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3033                 /* be paranoid and validate the laddr */
3034                 if (laddr->ifa == NULL) {
3035                         SCTPDBG(SCTP_DEBUG_ASCONF1,
3036                             "check_addr_list_ep: laddr->ifa is NULL");
3037                         continue;
3038                 }
3039                 /* do i have it implicitly? */
3040                 if (sctp_cmpaddr(&laddr->ifa->address.sa, init_addr)) {
3041                         continue;
3042                 }
3043                 /* check to see if in the init-ack */
3044                 if (!sctp_addr_in_initack(m, offset, length, &laddr->ifa->address.sa)) {
3045                         /* try to add it */
3046                         sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb, laddr->ifa,
3047                             SCTP_ADD_IP_ADDRESS, SCTP_ADDR_NOT_LOCKED);
3048                 }
3049         }
3050 }
3051
3052 /*
3053  * makes sure that the current kernel address list is consistent with the new
3054  * association (with all addrs bound) adds addresses as necessary
3055  */
3056 static void
3057 sctp_check_address_list_all(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3058     int length, struct sockaddr *init_addr,
3059     uint16_t local_scope, uint16_t site_scope,
3060     uint16_t ipv4_scope, uint16_t loopback_scope)
3061 {
3062         struct sctp_vrf *vrf = NULL;
3063         struct sctp_ifn *sctp_ifn;
3064         struct sctp_ifa *sctp_ifa;
3065         uint32_t vrf_id;
3066 #ifdef INET
3067         struct sockaddr_in *sin;
3068 #endif
3069 #ifdef INET6
3070         struct sockaddr_in6 *sin6;
3071 #endif
3072
3073         if (stcb) {
3074                 vrf_id = stcb->asoc.vrf_id;
3075         } else {
3076                 return;
3077         }
3078         SCTP_IPI_ADDR_RLOCK();
3079         vrf = sctp_find_vrf(vrf_id);
3080         if (vrf == NULL) {
3081                 SCTP_IPI_ADDR_RUNLOCK();
3082                 return;
3083         }
3084         /* go through all our known interfaces */
3085         LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
3086                 if (loopback_scope == 0 && SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
3087                         /* skip loopback interface */
3088                         continue;
3089                 }
3090                 /* go through each interface address */
3091                 LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
3092                         /* do i have it implicitly? */
3093                         if (sctp_cmpaddr(&sctp_ifa->address.sa, init_addr)) {
3094                                 continue;
3095                         }
3096                         switch (sctp_ifa->address.sa.sa_family) {
3097 #ifdef INET
3098                         case AF_INET:
3099                                 sin = &sctp_ifa->address.sin;
3100                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3101                                     &sin->sin_addr) != 0) {
3102                                         continue;
3103                                 }
3104                                 if ((ipv4_scope == 0) &&
3105                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
3106                                         /* private address not in scope */
3107                                         continue;
3108                                 }
3109                                 break;
3110 #endif
3111 #ifdef INET6
3112                         case AF_INET6:
3113                                 sin6 = &sctp_ifa->address.sin6;
3114                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3115                                     &sin6->sin6_addr) != 0) {
3116                                         continue;
3117                                 }
3118                                 if ((local_scope == 0) &&
3119                                     (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))) {
3120                                         continue;
3121                                 }
3122                                 if ((site_scope == 0) &&
3123                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
3124                                         continue;
3125                                 }
3126                                 break;
3127 #endif
3128                         default:
3129                                 break;
3130                         }
3131                         /* check to see if in the init-ack */
3132                         if (!sctp_addr_in_initack(m, offset, length, &sctp_ifa->address.sa)) {
3133                                 /* try to add it */
3134                                 sctp_addr_mgmt_assoc(stcb->sctp_ep, stcb,
3135                                     sctp_ifa, SCTP_ADD_IP_ADDRESS,
3136                                     SCTP_ADDR_LOCKED);
3137                         }
3138                 }               /* end foreach ifa */
3139         }                       /* end foreach ifn */
3140         SCTP_IPI_ADDR_RUNLOCK();
3141 }
3142
3143 /*
3144  * validates an init-ack chunk (from a cookie-echo) with current addresses
3145  * adds addresses from the init-ack into our local address list, if needed
3146  * queues asconf adds/deletes addresses as needed and makes appropriate list
3147  * changes for source address selection m, offset: points to the start of the
3148  * address list in an init-ack chunk length: total length of the address
3149  * params only init_addr: address where my INIT-ACK was sent from
3150  */
3151 void
3152 sctp_check_address_list(struct sctp_tcb *stcb, struct mbuf *m, int offset,
3153     int length, struct sockaddr *init_addr,
3154     uint16_t local_scope, uint16_t site_scope,
3155     uint16_t ipv4_scope, uint16_t loopback_scope)
3156 {
3157         /* process the local addresses in the initack */
3158         sctp_process_initack_addresses(stcb, m, offset, length);
3159
3160         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3161                 /* bound all case */
3162                 sctp_check_address_list_all(stcb, m, offset, length, init_addr,
3163                     local_scope, site_scope, ipv4_scope, loopback_scope);
3164         } else {
3165                 /* subset bound case */
3166                 if (sctp_is_feature_on(stcb->sctp_ep,
3167                     SCTP_PCB_FLAGS_DO_ASCONF)) {
3168                         /* asconf's allowed */
3169                         sctp_check_address_list_ep(stcb, m, offset, length,
3170                             init_addr);
3171                 }
3172                 /* else, no asconfs allowed, so what we sent is what we get */
3173         }
3174 }
3175
3176 /*
3177  * sctp_bindx() support
3178  */
3179 uint32_t
3180 sctp_addr_mgmt_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa,
3181     uint32_t type, uint32_t vrf_id)
3182 {
3183         struct sctp_ifa *ifa;
3184         struct sctp_laddr *laddr, *nladdr;
3185
3186         if (sa->sa_len == 0) {
3187                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3188                 return (EINVAL);
3189         }
3190         if (type == SCTP_ADD_IP_ADDRESS) {
3191                 /* For an add the address MUST be on the system */
3192                 ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
3193         } else if (type == SCTP_DEL_IP_ADDRESS) {
3194                 /* For a delete we need to find it in the inp */
3195                 ifa = sctp_find_ifa_in_ep(inp, sa, SCTP_ADDR_NOT_LOCKED);
3196         } else {
3197                 ifa = NULL;
3198         }
3199         if (ifa != NULL) {
3200                 if (type == SCTP_ADD_IP_ADDRESS) {
3201                         sctp_add_local_addr_ep(inp, ifa, type);
3202                 } else if (type == SCTP_DEL_IP_ADDRESS) {
3203                         if (inp->laddr_count < 2) {
3204                                 /* can't delete the last local address */
3205                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EINVAL);
3206                                 return (EINVAL);
3207                         }
3208                         LIST_FOREACH(laddr, &inp->sctp_addr_list,
3209                             sctp_nxt_addr) {
3210                                 if (ifa == laddr->ifa) {
3211                                         /* Mark in the delete */
3212                                         laddr->action = type;
3213                                 }
3214                         }
3215                 }
3216                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
3217                         /*
3218                          * There is no need to start the iterator if the inp
3219                          * has no associations.
3220                          */
3221                         if (type == SCTP_DEL_IP_ADDRESS) {
3222                                 LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3223                                         if (laddr->ifa == ifa) {
3224                                                 sctp_del_local_addr_ep(inp, ifa);
3225                                         }
3226                                 }
3227                         }
3228                 } else {
3229                         struct sctp_asconf_iterator *asc;
3230                         struct sctp_laddr *wi;
3231                         int ret;
3232
3233                         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
3234                             sizeof(struct sctp_asconf_iterator),
3235                             SCTP_M_ASC_IT);
3236                         if (asc == NULL) {
3237                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3238                                 return (ENOMEM);
3239                         }
3240                         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3241                         if (wi == NULL) {
3242                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
3243                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, ENOMEM);
3244                                 return (ENOMEM);
3245                         }
3246                         LIST_INIT(&asc->list_of_work);
3247                         asc->cnt = 1;
3248                         SCTP_INCR_LADDR_COUNT();
3249                         wi->ifa = ifa;
3250                         wi->action = type;
3251                         atomic_add_int(&ifa->refcount, 1);
3252                         LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
3253                         ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
3254                             sctp_asconf_iterator_stcb,
3255                             sctp_asconf_iterator_ep_end,
3256                             SCTP_PCB_ANY_FLAGS,
3257                             SCTP_PCB_ANY_FEATURES,
3258                             SCTP_ASOC_ANY_STATE,
3259                             (void *)asc, 0,
3260                             sctp_asconf_iterator_end, inp, 0);
3261                         if (ret) {
3262                                 SCTP_PRINTF("Failed to initiate iterator for addr_mgmt_ep_sa\n");
3263                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EFAULT);
3264                                 sctp_asconf_iterator_end(asc, 0);
3265                                 return (EFAULT);
3266                         }
3267                 }
3268                 return (0);
3269         } else {
3270                 /* invalid address! */
3271                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_ASCONF, EADDRNOTAVAIL);
3272                 return (EADDRNOTAVAIL);
3273         }
3274 }
3275
3276 void
3277 sctp_asconf_send_nat_state_update(struct sctp_tcb *stcb, struct sctp_nets *net)
3278 {
3279         struct sctp_asconf_addr *aa_vtag, *aa_add, *aa_del;
3280         struct sctp_ifa *sctp_ifap;
3281         struct sctp_asconf_tag_param *vtag;
3282 #ifdef INET
3283         struct sockaddr_in *to;
3284 #endif
3285 #ifdef INET6
3286         struct sockaddr_in6 *to6;
3287 #endif
3288
3289         if (net == NULL) {
3290                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing net\n");
3291                 return;
3292         }
3293         if (stcb == NULL) {
3294                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: Missing stcb\n");
3295                 return;
3296         }
3297         /*
3298          * Need to have in the ASCONF: - VTAG(my_vtag/peer_vtag) -
3299          * ADD(wildcard) - DEL(wildcard) - ADD(Any global addresses)
3300          */
3301         SCTP_MALLOC(aa_vtag, struct sctp_asconf_addr *, sizeof(struct sctp_asconf_addr), SCTP_M_ASC_ADDR);
3302         SCTP_MALLOC(aa_add, struct sctp_asconf_addr *, sizeof(struct sctp_asconf_addr), SCTP_M_ASC_ADDR);
3303         SCTP_MALLOC(aa_del, struct sctp_asconf_addr *, sizeof(struct sctp_asconf_addr), SCTP_M_ASC_ADDR);
3304
3305         if ((aa_vtag == NULL) || (aa_add == NULL) || (aa_del == NULL)) {
3306                 /* Didn't get memory */
3307                 SCTPDBG(SCTP_DEBUG_ASCONF1, "sctp_asconf_send_nat_state_update: failed to get memory!\n");
3308 out:
3309                 if (aa_vtag != NULL) {
3310                         SCTP_FREE(aa_vtag, SCTP_M_ASC_ADDR);
3311                 }
3312                 if (aa_add != NULL) {
3313                         SCTP_FREE(aa_add, SCTP_M_ASC_ADDR);
3314                 }
3315                 if (aa_del != NULL) {
3316                         SCTP_FREE(aa_del, SCTP_M_ASC_ADDR);
3317                 }
3318                 return;
3319         }
3320         memset(aa_vtag, 0, sizeof(struct sctp_asconf_addr));
3321         aa_vtag->special_del = 0;
3322         /* Fill in ASCONF address parameter fields. */
3323         /* Top level elements are "networked" during send. */
3324         aa_vtag->ifa = NULL;
3325         aa_vtag->sent = 0;      /* clear sent flag */
3326         vtag = (struct sctp_asconf_tag_param *)&aa_vtag->ap.aph;
3327         vtag->aph.ph.param_type = SCTP_NAT_VTAGS;
3328         vtag->aph.ph.param_length = sizeof(struct sctp_asconf_tag_param);
3329         vtag->local_vtag = htonl(stcb->asoc.my_vtag);
3330         vtag->remote_vtag = htonl(stcb->asoc.peer_vtag);
3331
3332         memset(aa_add, 0, sizeof(struct sctp_asconf_addr));
3333         memset(aa_del, 0, sizeof(struct sctp_asconf_addr));
3334         switch (net->ro._l_addr.sa.sa_family) {
3335 #ifdef INET
3336         case AF_INET:
3337                 aa_add->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3338                 aa_add->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3339                 aa_add->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3340                 aa_add->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3341                 /* No need to fill the address, we are using 0.0.0.0 */
3342                 aa_del->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3343                 aa_del->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addrv4_param);
3344                 aa_del->ap.addrp.ph.param_type = SCTP_IPV4_ADDRESS;
3345                 aa_del->ap.addrp.ph.param_length = sizeof(struct sctp_ipv4addr_param);
3346                 /* No need to fill the address, we are using 0.0.0.0 */
3347                 break;
3348 #endif
3349 #ifdef INET6
3350         case AF_INET6:
3351                 aa_add->ap.aph.ph.param_type = SCTP_ADD_IP_ADDRESS;
3352                 aa_add->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3353                 aa_add->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3354                 aa_add->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3355                 /* No need to fill the address, we are using ::0 */
3356                 aa_del->ap.aph.ph.param_type = SCTP_DEL_IP_ADDRESS;
3357                 aa_del->ap.aph.ph.param_length = sizeof(struct sctp_asconf_addr_param);
3358                 aa_del->ap.addrp.ph.param_type = SCTP_IPV6_ADDRESS;
3359                 aa_del->ap.addrp.ph.param_length = sizeof(struct sctp_ipv6addr_param);
3360                 /* No need to fill the address, we are using ::0 */
3361                 break;
3362 #endif
3363         default:
3364                 SCTPDBG(SCTP_DEBUG_ASCONF1,
3365                     "sctp_asconf_send_nat_state_update: unknown address family %d\n",
3366                     net->ro._l_addr.sa.sa_family);
3367                 goto out;
3368         }
3369         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa_vtag, next);
3370         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa_add, next);
3371         TAILQ_INSERT_TAIL(&stcb->asoc.asconf_queue, aa_del, next);
3372
3373         /* Now we must hunt the addresses and add all global addresses */
3374         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3375                 struct sctp_vrf *vrf = NULL;
3376                 struct sctp_ifn *sctp_ifnp;
3377                 uint32_t vrf_id;
3378
3379                 vrf_id = stcb->sctp_ep->def_vrf_id;
3380                 vrf = sctp_find_vrf(vrf_id);
3381                 if (vrf == NULL) {
3382                         goto skip_rest;
3383                 }
3384
3385                 SCTP_IPI_ADDR_RLOCK();
3386                 LIST_FOREACH(sctp_ifnp, &vrf->ifnlist, next_ifn) {
3387                         LIST_FOREACH(sctp_ifap, &sctp_ifnp->ifalist, next_ifa) {
3388                                 switch (sctp_ifap->address.sa.sa_family) {
3389 #ifdef INET
3390                                 case AF_INET:
3391                                         to = &sctp_ifap->address.sin;
3392                                         if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
3393                                             &to->sin_addr) != 0) {
3394                                                 continue;
3395                                         }
3396                                         if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3397                                                 continue;
3398                                         }
3399                                         if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3400                                                 continue;
3401                                         }
3402                                         break;
3403 #endif
3404 #ifdef INET6
3405                                 case AF_INET6:
3406                                         to6 = &sctp_ifap->address.sin6;
3407                                         if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
3408                                             &to6->sin6_addr) != 0) {
3409                                                 continue;
3410                                         }
3411                                         if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3412                                                 continue;
3413                                         }
3414                                         if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3415                                                 continue;
3416                                         }
3417                                         break;
3418 #endif
3419                                 default:
3420                                         continue;
3421                                 }
3422                                 sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3423                         }
3424                 }
3425                 SCTP_IPI_ADDR_RUNLOCK();
3426         } else {
3427                 struct sctp_laddr *laddr;
3428
3429                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
3430                         if (laddr->ifa == NULL) {
3431                                 continue;
3432                         }
3433                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED)
3434                                 /*
3435                                  * Address being deleted by the system, dont
3436                                  * list.
3437                                  */
3438                                 continue;
3439                         if (laddr->action == SCTP_DEL_IP_ADDRESS) {
3440                                 /*
3441                                  * Address being deleted on this ep don't
3442                                  * list.
3443                                  */
3444                                 continue;
3445                         }
3446                         sctp_ifap = laddr->ifa;
3447                         switch (sctp_ifap->address.sa.sa_family) {
3448 #ifdef INET
3449                         case AF_INET:
3450                                 to = &sctp_ifap->address.sin;
3451                                 if (IN4_ISPRIVATE_ADDRESS(&to->sin_addr)) {
3452                                         continue;
3453                                 }
3454                                 if (IN4_ISLOOPBACK_ADDRESS(&to->sin_addr)) {
3455                                         continue;
3456                                 }
3457                                 break;
3458 #endif
3459 #ifdef INET6
3460                         case AF_INET6:
3461                                 to6 = &sctp_ifap->address.sin6;
3462                                 if (IN6_IS_ADDR_LOOPBACK(&to6->sin6_addr)) {
3463                                         continue;
3464                                 }
3465                                 if (IN6_IS_ADDR_LINKLOCAL(&to6->sin6_addr)) {
3466                                         continue;
3467                                 }
3468                                 break;
3469 #endif
3470                         default:
3471                                 continue;
3472                         }
3473                         sctp_asconf_queue_mgmt(stcb, sctp_ifap, SCTP_ADD_IP_ADDRESS);
3474                 }
3475         }
3476 skip_rest:
3477         /* Now we must send the asconf into the queue */
3478         sctp_send_asconf(stcb, net, SCTP_ADDR_NOT_LOCKED);
3479 }